[java-plugin-shibd] branch main updated: Servlet 6.1 Cookie class has different behavior on empty attributes.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd/commit/afbac7fbead82dcc3e9e9520e2f232562478faa5

The following commit(s) were added to refs/heads/main by this push:
     new afbac7f  Servlet 6.1 Cookie class has different behavior on empty attributes.
afbac7f is described below

commit afbac7fbead82dcc3e9e9520e2f232562478faa5
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Dec 18 10:57:30 2025 -0500

    Servlet 6.1 Cookie class has different behavior on empty attributes.
---
 .../java/net/shibboleth/sp/messaging/RemotedHttpServletResponse.java | 5 ++++-
 .../shibboleth/sp/messaging/impl/RemotedHttpServletResponseTest.java | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletResponse.java b/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletResponse.java
index f8b5685..a91c605 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletResponse.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/messaging/RemotedHttpServletResponse.java
@@ -205,7 +205,10 @@ public class RemotedHttpServletResponse implements HttpServletResponse {
         }
         // All of the cookie properties are part of the "attributes" now.
         cookie.getAttributes().forEach((n, v) -> {
-            buffer.append("; ").append(n).append('=').append(v);
+            buffer.append("; ").append(n);
+            if (!v.isBlank()) {
+                buffer.append('=').append(v);
+            }
         });
         addHeader("Set-Cookie", buffer.toString());
     }
diff --git a/sp-server-impl/src/test/java/net/shibboleth/sp/messaging/impl/RemotedHttpServletResponseTest.java b/sp-server-impl/src/test/java/net/shibboleth/sp/messaging/impl/RemotedHttpServletResponseTest.java
index f7bab6e..6b9790a 100644
--- a/sp-server-impl/src/test/java/net/shibboleth/sp/messaging/impl/RemotedHttpServletResponseTest.java
+++ b/sp-server-impl/src/test/java/net/shibboleth/sp/messaging/impl/RemotedHttpServletResponseTest.java
@@ -70,7 +70,7 @@ public class RemotedHttpServletResponseTest {
         final DDF headers = obj.getmember("headers");
         assertTrue(headers.islist());
         final DDF cheader = headers.asList().stream().filter(ddf -> "Set-Cookie".equalsIgnoreCase(ddf.name())).findFirst().orElseThrow();
-        assertEquals(cheader.string(), "cookie1=value1; HttpOnly=true; Path=/idp; Secure=true");
+        assertEquals(cheader.string(), "cookie1=value1; HttpOnly; Path=/idp; Secure");
     }
 
     @Test

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.