From: Willy Tarreau <w@1wt.eu>
Date: Wed, 30 Sep 2026 09:31:39 +0000 (+0200)
Subject: BUG/MINOR: http-fetch: do not count Set-Cookie attributes as cookies
X-Git-Tag: v3.5-dev8~80
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=813c25055d539802d68b503913a6a298f85d491a;p=haproxy.git

BUG/MINOR: http-fetch: do not count Set-Cookie attributes as cookies

A Set-Cookie header contains a single cookie, and other elements on
the same line are not cookies but attributes (which can easily be
mistaken for them by a parser). That's what happens for res.cook_cnt()
which uses the same parser as req.cook_cnt() and counts apparent cookie
values without figuring it's parsing attributes. Let's just do like for
res.cookie_names() and check for a request or response before looping,
so that we can now count a single cookie per set-cookie response.

This can be backported to all stable versions.
---

diff --git a/src/http_fetch.c b/src/http_fetch.c
index c7c967cb3..af5dc3c07 100644
--- a/src/http_fetch.c
+++ b/src/http_fetch.c
@@ -1844,6 +1844,7 @@ static int smp_fetch_cookie_cnt(const struct arg *args, struct sample *smp, cons
 	char *val_beg, *val_end;
 	char *cook = NULL;
 	size_t cook_l = 0;
+	int is_req = !(check || (chn && chn->flags & CF_ISRESP));
 	int cnt;
 
 	if (args->type == ARGT_STR){
@@ -1854,7 +1855,7 @@ static int smp_fetch_cookie_cnt(const struct arg *args, struct sample *smp, cons
 	if (!htx)
 		return 0;
 
-	hdr = (!(check || (chn && chn->flags & CF_ISRESP)) ? ist("Cookie") : ist("Set-Cookie"));
+	hdr = (is_req ? ist("Cookie") : ist("Set-Cookie"));
 
 	val_end = val_beg = NULL;
 	ctx.blk = NULL;
@@ -1880,6 +1881,11 @@ static int smp_fetch_cookie_cnt(const struct arg *args, struct sample *smp, cons
 							    &smp->data.u.str.area,
 							    &smp->data.u.str.data))) {
 			cnt++;
+			if (!is_req) {
+				/* there's a single cookie per set-cookie header */
+				val_beg = NULL;
+				break;
+			}
 		}
 	}