Skip to content

fix: normalize Cookie header when proxying (RFC 7540)#251

Merged
augustoccesar merged 5 commits intomentimeter:mainfrom
jakst:fix/http2-cookie-normalization
Feb 25, 2026
Merged

fix: normalize Cookie header when proxying (RFC 7540)#251
augustoccesar merged 5 commits intomentimeter:mainfrom
jakst:fix/http2-cookie-normalization

Conversation

@jakst
Copy link
Contributor

@jakst jakst commented Feb 15, 2026

This fixes an HTTP/2 -> backend proxying bug where multiple Cookie header fields (or comma-joined cookie values) could be forwarded in an invalid form, causing the backend to miss cookies or parse them incorrectly. Per RFC 7540 §8.1.2.5, multiple Cookie header fields must be concatenated using semicolon when passed into a non-HTTP/2 context.

Implementation

  • Add linkup::normalize_cookie_header(...) to combine multiple Cookie headers with ; .
  • Also repairs the common bad case where Cookie fields were previously joined with commas (treat commas as split points, then re-join with semicolon).
  • Apply normalization in both proxy paths:
    • local-server/src/lib.rs (HTTP proxy + WS handshake header copy)
    • worker/src/lib.rs

Notes
My Rust is a bit rusty, and I’m not familiar with the Linkup repo, so these changes were heavily LLM-assisted. I’ve reviewed the logic and it looks sound, and I verified locally that a build with these changes resolves the issues we're having in the Endform repo.

Copy link
Member

@augustoccesar augustoccesar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the fix! ⭐
One question and a couple of suggestions.

@jakst
Copy link
Contributor Author

jakst commented Feb 25, 2026

Thank you for the fix! ⭐ One question and a couple of suggestions.

Thanks for the review! All suggestions implemented :)

@augustoccesar
Copy link
Member

There seems to be some issues with the worker that are unrelated to this PR.
I will take a look into it.

@augustoccesar
Copy link
Member

There seems to be some issues with the worker that are unrelated to this PR. I will take a look into it.

Hopefully #252 fixed this issue.
@jakst Can you rebase your branch?

Copy link
Member

@augustoccesar augustoccesar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jakst jakst force-pushed the fix/http2-cookie-normalization branch from 04bdab0 to 87fd86b Compare February 25, 2026 15:10
@augustoccesar augustoccesar merged commit a4ce9ab into mentimeter:main Feb 25, 2026
6 checks passed
@jakst jakst deleted the fix/http2-cookie-normalization branch February 25, 2026 15:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants