From dd7395a80a4af881abe306ffee4de3d962107067 Mon Sep 17 00:00:00 2001 From: johnnogueira Date: Wed, 10 Jun 2026 12:09:41 -0700 Subject: [PATCH] fix(cookies): normalize SameSite value to title-case on parse (#270) SameSite is case-insensitive per RFC 6265bis but servers send it in any casing (lax, LAX, Lax). Normalize to title-case at parse time so downstream comparisons work regardless. Unknown values fall back to Lax per spec. --- crates/obscura-net/src/cookies.rs | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/crates/obscura-net/src/cookies.rs b/crates/obscura-net/src/cookies.rs index 554c8a5..09890e3 100644 --- a/crates/obscura-net/src/cookies.rs +++ b/crates/obscura-net/src/cookies.rs @@ -72,7 +72,14 @@ impl CookieJar { } } "samesite" => { - same_site = val.trim().to_string(); + // SameSite is case-insensitive per RFC 6265bis; normalize to + // title-case so downstream comparisons work regardless of what + // the server sent. Unknown values default to Lax per spec. + same_site = match val.trim().to_ascii_lowercase().as_str() { + "strict" => "Strict", + "none" => "None", + _ => "Lax", + }.to_string(); } _ => {} } @@ -280,7 +287,14 @@ impl CookieJar { } } "samesite" => { - same_site = val.trim().to_string(); + // SameSite is case-insensitive per RFC 6265bis; normalize to + // title-case so downstream comparisons work regardless of what + // the server sent. Unknown values default to Lax per spec. + same_site = match val.trim().to_ascii_lowercase().as_str() { + "strict" => "Strict", + "none" => "None", + _ => "Lax", + }.to_string(); } _ => {} }