[BUG] RequestCookieExtractionFilter - System.ArgumentException: An item with the same key has already been added.

[ventii]

APM Agent version

Elastic.Apm.NetCoreAll 1.26.0

Environment

• .net alpine linux 7.0 (mcr.microsoft.com/dotnet/aspnet:7.0-alpine)

.NET Framework/Core name and version (e.g. .NET 4.6.2, NET Core 3.1.100) :

• NET Core 7.0.*

Application Target Framework(s) (e.g. net462, netcoreapp3.1):

• net7.0

Describe the bug

Since upgrading from 1.22.0 to 1.26.0, our REST API application has been throwing tens of the below warning logs. This also occurred when using 1.25.3:

{"PayloadSenderV2"} Exception during execution of the filter on transaction -

System.ArgumentException: An item with the same key has already been added. Key: --REDACTED--
   at bool System.Collections.Generic.Dictionary<TKey, TValue>.TryInsert(TKey key, TValue value, InsertionBehavior behavior)
   at Dictionary<string, string> Elastic.Apm.Helpers.CookieHeaderParser.ParseCookies(string cookieHeader)
   at void Elastic.Apm.Filters.RequestCookieExtractionFilter.HandleCookieHeader(Context context)
   at ITransaction Elastic.Apm.Filters.RequestCookieExtractionFilter.Filter(ITransaction transaction)
   at T Elastic.Apm.Report.PayloadSenderV2.TryExecuteFilter<T>(List<Func<T, T>> filters, T item)

I understand that a new APM filter RequestCookieExtractionFilter has been added by default which parses cookies, and we do in fact receive requests containing a large amount of cookies through our API, but we are unsure whether these requests genuinely contain duplicate cookie names or not.

To Reproduce

We have not managed to reproduce the warning log even by injecting multiple cookies with the same key unfortunately. Seems a bit odd.

The http.request.headers.Cookie for our requests should be containing values in the format key1=value;key2=value;

Expected behavior

RequestCookieExtractionFilter and CookieHeaderParser should handle the possibility of multiple cookies with the same key. Potentially, only taking into account the last value of the occurrance

Actual behavior

RequestCookieExtractionFilter fails with above exception and logs a warning message

[stevejgordon]

Thanks for raising this, @ventii. I've reproduced this in our test cases. I'll review some specs and then discuss what the "correct" behaviour should be in this situation.