Skip to content

fix(network): do not split single-valued and http-date headers on comma - #42723

Open
Mohan Ram (mohanram-dev) wants to merge 1 commit into
microsoft:mainfrom
mohanram-dev:fix/preserve-single-valued-headers
Open

Mohan Ram (mohanram-dev) wants to merge 1 commit into
microsoft:mainfrom
mohanram-dev:fix/preserve-single-valued-headers

Conversation

@mohanram-dev

Copy link
Copy Markdown

Description

Fixes #42687.

On Firefox and WebKit, response headers are provided joined or parsed through internal comma splitting (ffNetworkManager.ts and headersObjectToArray).

Per RFC 9110 §5.3, field lines containing an HTTP-date (Date, Expires, Last-Modified, If-Modified-Since, If-Unmodified-Since, Retry-After) and standard single-valued headers (Location, Content-Type, Content-Disposition, etc.) are not comma-separated lists. Splitting on , corrupted every date header (e.g., splitting "Wed, 21 Oct 2026 07:28:00 GMT" into "Wed" and "21 Oct 2026 07:28:00 GMT"). Additionally, on macOS WebKit where wkSetCookieSeparator = ',', cookies with Expires attributes containing commas were being split within the date string.

This PR:

  1. Defines singleValuedHeaders Set in packages/isomorphic/headers.ts containing standard single-valued and HTTP-date header names.
  2. Updates headersObjectToArray to preserve single-valued headers intact without splitting on ,.
  3. Adds splitSetCookieString to safely handle comma-separated Set-Cookie headers while preserving dates inside Expires=... attributes.
  4. Updates ffNetworkManager.ts (parseMultivalueHeaders) to avoid splitting single-valued and date headers on commas.
  5. Adds comprehensive unit tests (tests/library/unit/headers.spec.ts) and end-to-end response header tests (tests/page/page-network-response.spec.ts).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: headersArray() splits single header values on commas on Firefox and WebKit, corrupting every HTTP-date header

1 participant