[cpp-sp] branch main updated: Fix Max-Age handling in CookieManager.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=15e0a7acb73162f4c4d5a9de21a32d2ad941ee23

The following commit(s) were added to refs/heads/main by this push:
     new 15e0a7ac Fix Max-Age handling in CookieManager.
15e0a7ac is described below

commit 15e0a7acb73162f4c4d5a9de21a32d2ad941ee23
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jun 18 10:56:51 2025 -0400

    Fix Max-Age handling in CookieManager.
---
 shibsp/io/CookieManager.h                          |  6 +++++-
 shibsp/io/impl/CookieManager.cpp                   | 19 ++++++++++---------
 tests/session/impl/FilesystemSessionCacheTests.cpp |  4 ++--
 tests/session/impl/MemorySessionCacheTests.cpp     |  4 ++--
 4 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/shibsp/io/CookieManager.h b/shibsp/io/CookieManager.h
index cc50716d..1b7ccaae 100644
--- a/shibsp/io/CookieManager.h
+++ b/shibsp/io/CookieManager.h
@@ -109,7 +109,11 @@ namespace shibsp {
         void setDomain(const char* domain);
 
         /**
-         * Sets the default max-age for cookies created by this object.
+         * Sets the default max-age for cookies created by this object, or
+         * a -1 to inndicate a per-session cookie.
+         * 
+         * <p>The -1 convention matches Java's API but is not literally what
+         * the code does, it's a signal to omit max-age.</p>
          * 
          * <p>Defaults to -1.</p>
          * 
diff --git a/shibsp/io/impl/CookieManager.cpp b/shibsp/io/impl/CookieManager.cpp
index 165f7ec2..95d2aecb 100644
--- a/shibsp/io/impl/CookieManager.cpp
+++ b/shibsp/io/impl/CookieManager.cpp
@@ -139,23 +139,24 @@ void CookieManager::outputHeader(SPRequest& request, const char* value, int maxA
     if (value) {
         header += value;
     }
-    header += "; max-age=";
-    try {
-        header += boost::lexical_cast<string>(maxAge);
-    }
-    catch (boost::bad_lexical_cast&) {
-        header += "-1";
+    if (maxAge >= 0) {
+        try {
+            string s = boost::lexical_cast<string>(maxAge);
+            header += "; Max-Age=" + s;
+        }
+        catch (boost::bad_lexical_cast&) {
+        }
     }
     if (!m_path.empty()) {
-        header += "; path=";
+        header += "; Path=";
         header += m_path;
     }
     if (!m_domain.empty()) {
-        header += "; domain=";
+        header += "; Domain=";
         header += m_domain;
     }
     if (m_secure) {
-        header += "; secure=1";
+        header += "; Secure=1";
     }
     if (m_httpOnly) {
         header += "; HttpOnly=1";
diff --git a/tests/session/impl/FilesystemSessionCacheTests.cpp b/tests/session/impl/FilesystemSessionCacheTests.cpp
index 66fd86db..747f7eee 100644
--- a/tests/session/impl/FilesystemSessionCacheTests.cpp
+++ b/tests/session/impl/FilesystemSessionCacheTests.cpp
@@ -128,7 +128,7 @@ BOOST_FIXTURE_TEST_CASE(FilesystemSessionCache_tests, FilesystemFixture)
     string cookieName("__Host-shibsession_73702e6578616d706c652e6f7267637573746f6d");
     string header(cookieName);
     header += '=' + key;
-    header += "; max-age=-1; path=/; secure=1; HttpOnly=1; SameSite=None";
+    header += "; Path=/; Secure=1; HttpOnly=1; SameSite=None";
     BOOST_CHECK_EQUAL(request.m_responseHeaders["Set-Cookie"], header);
 
     string cookie(cookieName);
@@ -147,7 +147,7 @@ BOOST_FIXTURE_TEST_CASE(FilesystemSessionCache_tests, FilesystemFixture)
     cache->remove(request);
 
     header = cookieName;
-    header += "=; max-age=0; path=/; secure=1; HttpOnly=1; SameSite=None";
+    header += "=; Max-Age=0; Path=/; Secure=1; HttpOnly=1; SameSite=None";
     BOOST_CHECK_EQUAL(request.m_responseHeaders["Set-Cookie"], header);
     
     session = cache->find("custom", key.c_str());
diff --git a/tests/session/impl/MemorySessionCacheTests.cpp b/tests/session/impl/MemorySessionCacheTests.cpp
index a817320f..a6915f58 100644
--- a/tests/session/impl/MemorySessionCacheTests.cpp
+++ b/tests/session/impl/MemorySessionCacheTests.cpp
@@ -88,7 +88,7 @@ BOOST_FIXTURE_TEST_CASE(MemorySessionCache_tests, MemoryFixture)
     string cookieName("__Host-shibsession_73702e6578616d706c652e6f7267637573746f6d");
     string header(cookieName);
     header += '=' + key;
-    header += "; max-age=-1; path=/; secure=1; HttpOnly=1; SameSite=None";
+    header += "; Path=/; Secure=1; HttpOnly=1; SameSite=None";
     BOOST_CHECK_EQUAL(request.m_responseHeaders["Set-Cookie"], header);
 
     string cookie(cookieName);
@@ -107,7 +107,7 @@ BOOST_FIXTURE_TEST_CASE(MemorySessionCache_tests, MemoryFixture)
     cache->remove(request);
 
     header = cookieName;
-    header += "=; max-age=0; path=/; secure=1; HttpOnly=1; SameSite=None";
+    header += "=; Max-Age=0; Path=/; Secure=1; HttpOnly=1; SameSite=None";
     BOOST_CHECK_EQUAL(request.m_responseHeaders["Set-Cookie"], header);
     
     session = cache->find("custom", key.c_str());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.