thebadking/obscura
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(cookies): normalize SameSite value to title-case on parse (#270)

Browse Source 
SameSite is case-insensitive per RFC 6265bis but servers send it in any
casing (lax, LAX, Lax). Normalize to title-case at parse time so
downstream comparisons work regardless. Unknown values fall back to Lax
per spec.
This commit is contained in:
johnnogueira authored and GitHub committed 2026-06-10 19:09:41 +00:00
1 parent 6ba3c63596
commit dd7395a80a
1 file changed
+16 -2
Download Patch File Download Diff File Expand all files Collapse all files
crates/obscura-net/src/cookies.rs
+16 -2
View File
@@ -72,7 +72,14 @@ impl CookieJar {
}
}
"samesite" => {
same_site = val.trim().to_string();
// SameSite is case-insensitive per RFC 6265bis; normalize to
// title-case so downstream comparisons work regardless of what
// the server sent. Unknown values default to Lax per spec.
same_site = match val.trim().to_ascii_lowercase().as_str() {
"strict" => "Strict",
"none" => "None",
_ => "Lax",
}.to_string();
}
_ => {}
}
@@ -280,7 +287,14 @@ impl CookieJar {
}
}
"samesite" => {
same_site = val.trim().to_string();
// SameSite is case-insensitive per RFC 6265bis; normalize to
// title-case so downstream comparisons work regardless of what
// the server sent. Unknown values default to Lax per spec.
same_site = match val.trim().to_ascii_lowercase().as_str() {
"strict" => "Strict",
"none" => "None",
_ => "Lax",
}.to_string();
}
_ => {}
}