Share a header named Cookies by default, as only the Cookie header is blocked

pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsage.java

@@ -164,7 +164,6 @@ public EvidenceKeyFilterShareUsage(
         this.shareAllQueryStringParameters = shareAllQueryStringParameters;
         // The Cookie header carries every cookie, including the ones the
         // cookie rule leaves out.
-        this.blockedHttpHeaders.add("cookies");
         this.blockedHttpHeaders.add("cookie");
         this.includeSession = includeSession;
         this.sessionCookieName = sessionCookieName == null ?

pipeline/pipeline.engines.fiftyone/src/main/java/fiftyone/pipeline/engines/fiftyone/flowelements/ShareUsageBuilderBase.java

@@ -201,47 +201,44 @@ public boolean isShareAllEvidence() {
     }
 
     /**
-     * By default, all HTTP headers (excluding a few such as 'cookies', if they
-     * don't start with 51D_) are shared. Individual headers can be excluded from sharing by
-     * adding them to this list.
+     * By default, every HTTP header is shared except Cookie. Individual
+     * headers can be excluded from sharing by adding them to this list.
      * <p>
      * This setter replaces the current list
      * @param blockedHeaders the (case-insensitive) names of the headers to block
      * @return this builder
      */
-    @DefaultValue("All HTTP Headers are shared except cookies that do not start with 51D_")
+    @DefaultValue("All HTTP headers are shared except Cookie")
     public ShareUsageBuilderBase<T> setBlockedHttpHeaders(List<String> blockedHeaders) {
         blockedHttpHeaders = blockedHeaders;
         return this;
     }
 
     /**
-     * By default, all HTTP headers (excluding a few such as 'cookies', if they
-     * don't start with 51D_) are shared. Individual headers can be excluded from sharing by
-     * adding them to this list.
+     * By default, every HTTP header is shared except Cookie. Individual
+     * headers can be excluded from sharing by adding them to this list.
      * <p>
      * This setter adds to the blocked headers
      * @param blockedHeaders a comma separated list of
      *                                  (case-insensitive) names of the
      *                                  headers to include
      * @return this builder
      */
-    @DefaultValue("All HTTP Headers are shared except cookies that do not start with 51D_")
+    @DefaultValue("All HTTP headers are shared except Cookie")
     public ShareUsageBuilderBase<T> setBlockedHttpHeaders(String blockedHeaders) {
         blockedHttpHeaders.addAll(Arrays.asList(blockedHeaders.split("\\s*,\\s*")));
         return this;
     }
 
     /**
-     * By default, all HTTP headers (excluding a few such as 'cookies', if they
-     * don't start with 51D_) are shared. Individual headers can be excluded from sharing by
-     * adding them to this list.
+     * By default, every HTTP header is shared except Cookie. Individual
+     * headers can be excluded from sharing by adding them to this list.
      * <p>
      * This setter allows you to add the name of a header to block.
      * @param blockedHeader the (case-insensitive) name of the header to block
      * @return this builder
      */
-    @DefaultValue("All HTTP Headers are shared except cookies that do not start with 51D_")
+    @DefaultValue("All HTTP headers are shared except Cookie")
     public ShareUsageBuilderBase<T> setBlockedHttpHeader(String blockedHeader) {
         blockedHttpHeaders.add(blockedHeader.trim());
         return this;

pipeline/pipeline.engines.fiftyone/src/test/java/fiftyone/pipeline/engines/fiftyone/data/EvidenceKeyFilterShareUsageTests.java

@@ -187,6 +187,33 @@ public void cookieHeaderNeverShared() {
         assertTrue(filter.include("server.request-method"));
     }
 
+    /**
+     * By default every header but Cookie is shared, so a header named
+     * Cookies is shared like any other header.
+     */
+    @Test
+    public void onlyTheCookieHeaderIsBlockedByDefault() {
+        EvidenceKeyFilterShareUsage filter = defaults();
+        assertFalse(filter.include("header.cookie"));
+        assertFalse(filter.include("header.Cookie"));
+        assertTrue(filter.include("header.cookies"));
+        assertTrue(filter.include("header.Cookies"));
+    }
+
+    /**
+     * A header named Cookies is blocked when the blocked headers name it.
+     */
+    @Test
+    public void aCookiesHeaderIsBlockedWhenNamed() {
+        EvidenceKeyFilterShareUsage filter = filter(
+            Collections.singletonList("Cookies"),
+            Collections.<String>emptyList(),
+            false);
+        assertFalse(filter.include("header.cookies"));
+        assertFalse(filter.include("header.Cookies"));
+        assertFalse(filter.include("header.cookie"));
+    }
+
     /**
      * A key that only ends with the same letters as a key never shared is
      * treated as an ordinary key.