Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix[bug] -> Session cookies without Double quotes #148

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

pyleo-1998
Copy link

The session cookie values exhibit an additional presence of double quotes within the value, as clearly demonstrated in the attached screenshot depicting the tracked Scala request in Burp Suite.
scala_request_lib
As a consequence, the requested server is unable to retrieve the information associated with the cookies sent in the requested payload.
The updated pull request has modified the source code of the Scala request to include the cookie values without double quotes. The tracked HTTP request in the Burp Suite, depicted in the screenshot below, was sent by the modified Scala request library.
modifies_scala_request_lib

@mslxl
Copy link

mslxl commented Dec 27, 2023

I met the same problem, the double quote will prevent some server from parse its value(like pixiv.net uses). So I tried to find some information.

The quote was added on #73, based on RFC2109. But RFC2109 defined syntax of cookie as following:

cookie          =       "Cookie:" cookie-version
                        1*((";" | ",") cookie-value)
cookie-value    =       NAME "=" VALUE [";" path] [";" domain]
cookie-version  =       "$Version" "=" value
NAME            =       attr
VALUE           =       value
path            =       "$Path" "=" value
domain          =       "$Domain" "=" value

attr            =       token
value           =       word
word            =       token | quoted-string

where the token is a sequence of non-special, non-white space characters.

Obviously, #73 missing cookie-version to specific version, which may caused server did not work. And even add cookie-version, some server still not support it yet.

Maybe is better to add a option cookieVersion to choose corresponding version, or just use cookie version 0 simply(by removing double quote and add URLEncode to escape whitespace etc.), or do noting when send data, let user preprocess the header by hand

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants