[jwrosewell]

Problem

The usage sharing filter blocks two headers by default where the specification blocks one. EvidenceKeyFilterShareUsage adds both cookies and cookie to its blocked headers whatever it is given (lines 165 to 168 at rc 1c99b72f), so a request header named Cookies is never shared unless all Evidence is shared. Cookies is not the Cookie header, so it is an ordinary header that the specification shares by default.

The three setBlockedHttpHeaders and setBlockedHttpHeader methods of ShareUsageBuilderBase also describe the default wrongly. Their Javadoc says "all HTTP headers (excluding a few such as 'cookies', if they don't start with 51D_) are shared", and their @DefaultValue reads "All HTTP Headers are shared except cookies that do not start with 51D_" (lines 212, 229 and 244 at rc 1c99b72f), which mixes the header rule up with the cookie rule.

A check of every language against the rule that usage sharing shares every HTTP header not flagged as personal, with the raw Cookie header left out, found this gap in Java. .NET had the same gap and fixed it in 51degrees-dotnet#172, merged into its rc.

What the specification says

usage-sharing-element.md at 6570727d, "Shared Evidence" names the keys that are never shared, among them

header.cookie, which is the Cookie header of the request and carries every cookie (RFC 6265 section 5.4).

and then says that, unless all Evidence is shared, the filter "MUST also return false for any key where" the "Prefix = header. and field is in a user-configurable block list", and "Anything else MUST return true. (i.e. it will be shared)".

The configuration options table, line 404 gives the default of "Blocked HTTP headers" as

All HTTP headers are shared except Cookie

RFC 6265 section 5.4 names the request header that carries cookies as Cookie. No header named Cookies is defined there.

What changed

1. EvidenceKeyFilterShareUsage no longer adds cookies to the blocked headers. cookie is still always blocked, as the specification asks.
2. The Javadoc and @DefaultValue of the three blocked header setters on ShareUsageBuilderBase now say "every HTTP header is shared except Cookie" and "All HTTP headers are shared except Cookie", the words of the specification's table.

No public name is removed or renamed. An application that wants a header named Cookies left out adds it to the blocked headers, which the second new test shows working.

Tests

Written first (commit bc2872d), in EvidenceKeyFilterShareUsageTests.

• onlyTheCookieHeaderIsBlockedByDefault. With the default settings, header.cookie and header.Cookie are not shared, and header.cookies and header.Cookies are.
• aCookiesHeaderIsBlockedWhenNamed. With Cookies in the blocked headers, header.cookies and header.Cookies are not shared, and header.cookie still is not.

The runs build pipeline.engines.fiftyone with the modules it needs and run the usage sharing test classes on the runner's Java, on Ubuntu.

• Red, the tests on rc 30e4886 (commit 0028d70 on a temporary branch): run 43536125839. EvidenceKeyFilterShareUsageTests ran 12 with 1 failure, onlyTheCookieHeaderIsBlockedByDefault at line 199, where header.cookies was not shared.
• Green, commit 8e03f59, which is c76978d with the temporary workflow added: run 43536140778. 76 tests ran and none failed.

rc 1c99b72 is merged into this draft (merge commit ebe35da, no conflicts). rc gained #83 in the same file since, which compares keys in the root locale, and the full build below runs the tests on the merged code.

Build

Full build 43594488581 on head ebe35da passed. Configure and all nine Build and Test jobs succeeded (Ubuntu Java 8, 11, 17 and 21, Ubuntu ARM Java 17, and Windows Java 8, 11, 17 and 21), and all 10 PullRequestSha lines in the job logs read ebe35da. Configure printed "Left out 6 macOS entries".

macOS was left out of this draft's full build under the 9 November decision. The rc head is built with macOS before it merges into main.

Before you upgrade

A request header named Cookies is now shared by usage sharing by default, as every other header but Cookie is. To keep it out, add it to the blocked headers with setBlockedHttpHeader("Cookies") on the usage sharing builder.

What remains

Nothing for this change.