From 67290bfea61c81347464539f5e6d0a7cebec1fc8 Mon Sep 17 00:00:00 2001 From: Vadim Zhestikov Date: Fri, 9 Oct 2026 12:08:23 -0700 Subject: [PATCH] Fixed $cookie_ after a cookie without a name A cookie without a name, such as "a" in "Cookie: a; a=1", was skipped together with the separator that follows it, so the next cookie was skipped as well and $cookie_a was not found. The userid module was affected in the same way. User agents send a cookie with an empty name as a bare value (RFC 6265bis, section 5.8.3), so such a token is a valid part of the Cookie header. The fix is to not consume the character that fails the "=" check. The problem appeared in 899b44eab (0.1.29). --- src/http/ngx_http_parse.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c index 1fa40cc6c..c69d8ef70 100644 --- a/src/http/ngx_http_parse.c +++ b/src/http/ngx_http_parse.c @@ -2054,11 +2054,13 @@ ngx_http_parse_multi_header_lines_internal(ngx_http_request_t *r, goto skip; } - if (start == end || *start++ != '=') { + if (start == end || *start != '=') { /* the invalid header value */ goto skip; } + start++; + while (start < end && *start == ' ') { start++; } for (last = start; last < end && *last != sep; last++) { -- 2.47.3