Azure-functions-host: Proxy merges multiple cookie headers into one

[macgyver2k]

This makes all modern browsers only capture the first cookie.

Investigative information

• Timestamp: Wed, 22 May 2019 14:48:15 GMT
• Function App version (1.0 or 2.0): 2.0
• Region: Westeurope

Repro steps

Create function proxy to and endpoint that returns multiple cookies in one response.

Expected behavior

The multiple "Set-Cookie" headers should be transported as they are, one-by-one, into the response. example:

Set-Cookie: idsrv.session=21bxxxxxxxxxxxxxxxxxxxxx93b1; path=/; secure
Set-Cookie: .AspNetCore.Identity.Application=CfDJ8EXV_uoT8urq1HrndD5I; expires=Wed, 05 Jun 2019 14:48:15 GMT; path=/; secure; httponly

Actual behavior

However, the function proxy meges the two returned cookies into one comma separated value:

Set-Cookie: idsrv.session=21bxxxxxxxxxxxxxxxxxxxxx93b1; path=/; secure, .AspNetCore.Identity.Application=CfDJ8EXV_uoT8urq1HrndD5I; expires=Wed, 05 Jun 2019 14:40:59 GMT; path=/; secure; httponly

This makes it impossible to authenticate via this function proxy.

[AllisonBolen]

I am also experiencing this problem:

Original (link w/o proxy):
Set-Cookie: ...value.. ,
Set-Cookie: ..value... ,
Set-....

Proxy link :
Set-Cookie: ...value..., ...value..., ...value..., ...

We looked into possibly intercepting the request and splitting the cookie headers ourselves, but doesn't look like its possible. If there is a hot fix to use in the mean time, we would love to know.

[mikeking27]

I have experienced this same issue as well, as documented above. It would be nice to see a resolution for this.

[macgyver2k]

I once encountered an error page for the proxy. It looked pretty much like a Jetty error page. So the problem may not be fixable inside Azure Functions implementation. I also could not find any line of code beeing accountable for this issue inside Azure Functions.

[mgfink]

@AllisonBolen we're running into the same issue. You mentioned looking at splitting the cookie headers yourselves and was going to try something similar. I was wondering if you were doing that within the function and trying to override the response headers?

[safihamid]

@vfedonkin would you please investigate this?

[vfedonkin]

Looking...

[AllisonBolen]

We decided to use Nginx as a proxy, but would love to see a fix for this soon so we can utilize this in the future.

[vfedonkin]

According to http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 :
Multiple message-header fields with the same field-name MAY bepresent in a message if and only if the entire field-value for thatheader field is defined as a comma-separated list [i.e., #(values)].It MUST be possible to combine the multiple header fields into one"field-name: field-value" pair, without changing the semantics of themessage, by appending each subsequent field-value to the first, eachseparated by a comma. The order in which header fields with the samefield-name are received is therefore significant to theinterpretation of the combined field value, and thus a proxy MUST NOTchange the order of these field values when a message is forwarded.

.Net framework combines headers automatically when getting HttpWebResponse.

Anyway, the task for Api Management team was created to pass backend provided headers as is, so backend should be responsible for that logic.

After the task is done and tested we will apply same changes to the functions proxy.

[mgfink]

Would it be possible to tweak the proxy somehow to alter the back-end response headers as follows?

Before:
Set-Cookie: ...value..., ...value..., ...value..., ...

After:
Set-Cookie: ...value.. ,
Set-Cookie: ..value... ,

I'm wondering if this is something that could be done on the user side since we have the ability to alter response headers.

[fabiocav]

@vfedonkin is this something that has been done in APIM? Are you still thinking about backporting this to Proxies?

[vfedonkin]

@fabiocav , yes, we fixed this in APIM. Will fix it in Functions Proxies soon.

[fabiocav]

Thank you. Flagging this as triaged for now as it is still on the radar.

[ZivotJeKrasny]

@vfedonkin Do you have some estimation when it will be fixed in Functions Proxies, please?

[vfedonkin]

Having issues with accessing original headers in .net core. Trying to solve but didn't find solution yet. No ETA.

[vfedonkin]

There is a bug in .net core implementation, need to wait till this issue is resolved: https://github.com/dotnet/corefx/issues/39527

[chuanqisun]

Is there any work-around for this? Would switching runtime work?

I experienced the same issue while trying to proxy against a Vercel (prev. Zeit) serverless function. In the screenshot, left is original response. Right is proxied response.