replicator session auth cannot handle multiple Set-Cookie headers in /_session request

[janl]

A HTTP response for /_session that includes two Set-Cookie headers leads to a {error, cookie_format_invalid}; error and failed replication job/

For example. a load balancer could introduce its own Set-Cookie lines:

< Set-Cookie: AuthSession=…; Version=1; Expires=Tue, 21-May-2024 14:24:57 GMT; Max-Age=600; Secure; Path=/; HttpOnly
< Set-Cookie: BIGipServer~example.com=1234567890.18459.0000; path=/; Httponly; Secure

And the session auth handler doesn’t handle this correctly. The only workaround is forcing the _noop handler which has other downsides.

[nickva]

Playing a bit with mochiweb headers parser, I think we may have to use mochiweb_headers:to_list/1, then go through each 'Set-Cookie' parse out the cookie and ignore any not coming from CouchDB?

Heads = mochiweb_headers:from_binary([<<"Content-Length:47\r\n">>, <<"Set-Cookie:Custom=ABC; Version=42\r\n">>, <<"Foo:bar\r\n">>, <<"sEt-cOokie:Kustom=DEF; Version=43\r\n\rn">>]), ok.
ok

> mochiweb_headers:get_value("set-cookie", Heads).
"Kustom=DEF; Version=43, Custom=ABC; Version=42"

> mochiweb_headers:get_primary_value("set-cookie", Heads).
"Kustom=DEF"

> mochiweb_headers:get_combined_value("set-cookie", Heads).
undefined

> mochiweb_headers:to_list(Heads).
[{'Content-Length',"47"},
 {"Foo","bar"},
 {'Set-Cookie',"Kustom=DEF; Version=43"},
 {'Set-Cookie',"Custom=ABC; Version=42"}]