Motivation: RFC6265 specifies which characters are allowed in a cookie name and value. Netty is currently too lax, which can used for HttpOnly escaping. Modification: In ServerCookieDecoder: discard cookie key-value pairs that contain invalid characters. In ClientCookieEncoder: throw an exception when trying to encode cookies with invalid characters. Drop old Cookie encoders and decoders that were deprecated in 4.1. Result: The problem described in the motivation section is fixed. |
||
---|---|---|
.. | ||
src/main | ||
.gitignore | ||
pom.xml |