From bc2872d10d65b576656ec29c44c9db67f737863f Mon Sep 17 00:00:00 2001 From: James Rosewell Date: Sat, 14 Nov 2026 00:43:36 +0000 Subject: [PATCH 1/2] Test that only the Cookie header is blocked by default A header named Cookies is shared like any other header, unless the blocked headers name it. --- .../EvidenceKeyFilterShareUsageTests.java | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/pipeline/pipeline.engines.fiftyone/src/test/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsageTests.java b/pipeline/pipeline.engines.fiftyone/src/test/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsageTests.java index 33eacefc6..8aeb6e7f8 100644 --- a/pipeline/pipeline.engines.fiftyone/src/test/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsageTests.java +++ b/pipeline/pipeline.engines.fiftyone/src/test/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsageTests.java @@ -187,6 +187,33 @@ public void cookieHeaderNeverShared() { assertTrue(filter.include("server.request-method")); } + /** + * By default every header but Cookie is shared, so a header named + * Cookies is shared like any other header. + */ + @Test + public void onlyTheCookieHeaderIsBlockedByDefault() { + EvidenceKeyFilterShareUsage filter = defaults(); + assertFalse(filter.include("header.cookie")); + assertFalse(filter.include("header.Cookie")); + assertTrue(filter.include("header.cookies")); + assertTrue(filter.include("header.Cookies")); + } + + /** + * A header named Cookies is blocked when the blocked headers name it. + */ + @Test + public void aCookiesHeaderIsBlockedWhenNamed() { + EvidenceKeyFilterShareUsage filter = filter( + Collections.singletonList("Cookies"), + Collections.emptyList(), + false); + assertFalse(filter.include("header.cookies")); + assertFalse(filter.include("header.Cookies")); + assertFalse(filter.include("header.cookie")); + } + /** * A key that only ends with the same letters as a key never shared is * treated as an ordinary key. From c76978d52d8dbbcb064985cdb658372ae977f841 Mon Sep 17 00:00:00 2001 From: James Rosewell Date: Sat, 14 Nov 2026 00:43:45 +0000 Subject: [PATCH 2/2] Share a header named Cookies by default The usage sharing filter blocked a header named Cookies as well as the Cookie header. The specification's default is that all HTTP headers are shared except Cookie, so only Cookie is blocked now, and the blocked headers option still blocks any header it names. The builder's documentation gave the default as cookies that do not start with 51D_, which is the rule for cookies and not for headers. --- .../data/EvidenceKeyFilterShareUsage.java | 1 - .../flowelements/ShareUsageBuilderBase.java | 21 ++++++++----------- 2 files changed, 9 insertions(+), 13 deletions(-) diff --git a/pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsage.java b/pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsage.java index 3bfd42e8f..3a635ea9c 100644 --- a/pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsage.java +++ b/pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsage.java @@ -163,7 +163,6 @@ public EvidenceKeyFilterShareUsage( this.shareAllQueryStringParameters = shareAllQueryStringParameters; // The Cookie header carries every cookie, including the ones the // cookie rule leaves out. - this.blockedHttpHeaders.add("cookies"); this.blockedHttpHeaders.add("cookie"); this.includeSession = includeSession; this.sessionCookieName = sessionCookieName == null ? diff --git a/pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/flowelements/ShareUsageBuilderBase.java b/pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/flowelements/ShareUsageBuilderBase.java index 6e07f6dd3..1ab56e3f9 100644 --- a/pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/flowelements/ShareUsageBuilderBase.java +++ b/pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/flowelements/ShareUsageBuilderBase.java @@ -201,24 +201,22 @@ public boolean isShareAllEvidence() { } /** - * By default, all HTTP headers (excluding a few such as 'cookies', if they - * don't start with 51D_) are shared. Individual headers can be excluded from sharing by - * adding them to this list. + * By default, every HTTP header is shared except Cookie. Individual + * headers can be excluded from sharing by adding them to this list. *

* This setter replaces the current list * @param blockedHeaders the (case-insensitive) names of the headers to block * @return this builder */ - @DefaultValue("All HTTP Headers are shared except cookies that do not start with 51D_") + @DefaultValue("All HTTP headers are shared except Cookie") public ShareUsageBuilderBase setBlockedHttpHeaders(List blockedHeaders) { blockedHttpHeaders = blockedHeaders; return this; } /** - * By default, all HTTP headers (excluding a few such as 'cookies', if they - * don't start with 51D_) are shared. Individual headers can be excluded from sharing by - * adding them to this list. + * By default, every HTTP header is shared except Cookie. Individual + * headers can be excluded from sharing by adding them to this list. *

* This setter adds to the blocked headers * @param blockedHeaders a comma separated list of @@ -226,22 +224,21 @@ public ShareUsageBuilderBase setBlockedHttpHeaders(List blockedHeader * headers to include * @return this builder */ - @DefaultValue("All HTTP Headers are shared except cookies that do not start with 51D_") + @DefaultValue("All HTTP headers are shared except Cookie") public ShareUsageBuilderBase setBlockedHttpHeaders(String blockedHeaders) { blockedHttpHeaders.addAll(Arrays.asList(blockedHeaders.split("\\s*,\\s*"))); return this; } /** - * By default, all HTTP headers (excluding a few such as 'cookies', if they - * don't start with 51D_) are shared. Individual headers can be excluded from sharing by - * adding them to this list. + * By default, every HTTP header is shared except Cookie. Individual + * headers can be excluded from sharing by adding them to this list. *

* This setter allows you to add the name of a header to block. * @param blockedHeader the (case-insensitive) name of the header to block * @return this builder */ - @DefaultValue("All HTTP Headers are shared except cookies that do not start with 51D_") + @DefaultValue("All HTTP headers are shared except Cookie") public ShareUsageBuilderBase setBlockedHttpHeader(String blockedHeader) { blockedHttpHeaders.add(blockedHeader.trim()); return this;