Spring-framework: No way to replace Set-Cookie header via MockHttpServletResponse

[philsmart]

I am trying to test a servlet filter passing it an instance of MockHttpServletResponse.

The filter attempts to overwrite existing Set-Cookie headers with a new Set-Cookie header calling the response.setHeader method. This works on Jetty and Tomcat, however it does not work on the MockHttpServletResponse - leading my tests to fail.

The MockHttpServletResponse actually adds a new Set-Cookie header when using the setHeader method - possibly in contradiction to the HttpServletResponse interface contract.

From inspection, it appears the setSpecialHeader method contains a treatment of Set-Cookie which other container implementations do not have. In other containers e.g. Jetty or Tomcat, the set of special headers is limited to Content-Type or Content-Length. In the MockHttpServletResponse, the set of special headers also contains Language and Set-Cookie (see line 589) - which then leads to the Set-Cookie header to be added, rather than replaced.

This difference means I can not test the behavior of my filter in a way consistent with how it will be deployed.

[sbrannen]

@philsmart, can you please let us know which version of spring-test you are using?

[philsmart]

Hi, sorry. That would be spring-test 5.1.5.RELEASE

[rstoyanchev]

It looks like support for cookies via setHeader was added relatively recently in 5.1 with #21647. Perhaps setSpecialHeader was an obvious place to put this in, but the other special headers are not additive and from that perspective cookies are a different kind of special header that needs to differentiate between setHeader vs addHeader.

@vpavic if there was anything more that I'm missing please do comment. If not I propose that we make the change.

[philsmart]

Thanks for this. This is actually related to #21647, in that I am also trying to manage SameSite on cookies using setHeader and addHeader.

[vpavic]

@rstoyanchev Right now I don't recall any specific reason to use setHeader vs setSpecialHeader.

Spring Session's master branch currently builds against Framework's snapshot so we should quickly find out if something goes wrong due to this change.

[sbrannen]

Thanks for the feedback @philsmart and @vpavic.

I'm also in favor of making the change.

[sbrannen]

This has already been implemented for 5.1.10 in 8189c90741725feb3432ab55dd7d91298fc7cf9d.

Note, however, that there is not currently a snapshot build to try it out, since our CI build plan is currently broken for all branches except master.

[vpavic]

I can confirm that Spring Session's master builds OK against current 5.2.0.BUILD-SNAPSHOT containing these changes.

[philsmart]

I can confirm that 5.2.0.BUILD-SNAPSHOT has fixed my issue, and my tests are working fine.

[sbrannen]

Great! Thanks for letting us know.

BTW, the 5.1.10 snapshot should be available now as well, since @bclozel fixed the build. 👍