fix: normalize Cookie header when proxying (RFC 7540)#251
Merged
augustoccesar merged 5 commits intomentimeter:mainfrom Feb 25, 2026
Merged
fix: normalize Cookie header when proxying (RFC 7540)#251augustoccesar merged 5 commits intomentimeter:mainfrom
augustoccesar merged 5 commits intomentimeter:mainfrom
Conversation
Member
augustoccesar
left a comment
There was a problem hiding this comment.
Thank you for the fix! ⭐
One question and a couple of suggestions.
Contributor
Author
Thanks for the review! All suggestions implemented :) |
Member
|
There seems to be some issues with the worker that are unrelated to this PR. |
Member
Concatenate multiple Cookie header fields with '; ' per RFC 7540 and repair comma-joined values so backends receive a single valid Cookie header.
04bdab0 to
87fd86b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This fixes an HTTP/2 -> backend proxying bug where multiple Cookie header fields (or comma-joined cookie values) could be forwarded in an invalid form, causing the backend to miss cookies or parse them incorrectly. Per RFC 7540 §8.1.2.5, multiple Cookie header fields must be concatenated using semicolon when passed into a non-HTTP/2 context.
Implementation
;.Notes
My Rust is a bit rusty, and I’m not familiar with the Linkup repo, so these changes were heavily LLM-assisted. I’ve reviewed the logic and it looks sound, and I verified locally that a build with these changes resolves the issues we're having in the Endform repo.