响应时的 Apache HttpClient 标头问题

Question

我使用 Apache HttpClient 和 java.sun.net.httpserver 作为服务器。服务器处理 Http-Get 请求。一开始，服务器使用 set-cookie 标头设置会话 cookie，它被 apache httpclient 接受（根据日志），但问题是 cookie 从未被客户端存储或发送回服务器。 我已经用一些网络浏览器测试了服务器应用程序，一切正常。所以问题似乎出在客户端，特别是考虑到所有 cookie 都被接受根据 log4j 登录的事实。

DEBUG [org.apache.http.impl.conn.SingleClientConnManager] Get connection for route HttpRoute[{}->http://localhost]
DEBUG [org.apache.http.impl.conn.DefaultClientConnectionOperator] Connecting to localhost/127.0.0.1:80
DEBUG [org.apache.http.client.protocol.RequestAddCookies] CookieSpec selected: best-match
DEBUG [org.apache.http.client.protocol.RequestAuthCache] Auth cache not set in the context
DEBUG [org.apache.http.impl.client.DefaultHttpClient] Attempt 1 to execute request
DEBUG [org.apache.http.impl.conn.DefaultClientConnection] Sending request: GET /login?pass=2Gi/Kzj9 HTTP/1.1
DEBUG [org.apache.http.headers] >> GET /login?pass=2Gi/Kzj9 HTTP/1.1
DEBUG [org.apache.http.headers] >> Host: localhost
DEBUG [org.apache.http.headers] >> Connection: Keep-Alive
DEBUG [org.apache.http.headers] >> User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
DEBUG [org.apache.http.impl.conn.DefaultClientConnection] Receiving response: HTTP/1.1 200 OK
DEBUG [org.apache.http.headers] << HTTP/1.1 200 OK
DEBUG [org.apache.http.headers] << Transfer-encoding: chunked
DEBUG [org.apache.http.headers] << Content-type: text/html
DEBUG [org.apache.http.headers] << Set-cookie: SESSID=0.6092204529970631; expires=Tue, 19-4-11 18:28:43 GMT; Max-Age=3600; Path=/; Version="1"
DEBUG [org.apache.http.client.protocol.ResponseProcessCookies] Cookie accepted: "[version: 0][name: SESSID][value: 0.6092204529970631][domain: localhost][path: /][expiry: Sun Apr 19 19:28:43 CET 11]". 
DEBUG [org.apache.http.impl.client.DefaultHttpClient] Connection can be kept alive indefinitely
DEBUG [org.apache.http.impl.conn.SingleClientConnManager] Releasing connection org.apache.http.impl.conn.SingleClientConnManager$ConnAdapter@1bd0dd4
DEBUG [org.apache.http.impl.conn.SingleClientConnManager] Get connection for route HttpRoute[{}->http://localhost]
DEBUG [org.apache.http.impl.client.DefaultHttpClient] Stale connection check
DEBUG [org.apache.http.client.protocol.RequestAddCookies] CookieSpec selected: best-match
DEBUG [org.apache.http.client.protocol.RequestAuthCache] Auth cache not set in the context
DEBUG [org.apache.http.impl.client.DefaultHttpClient] Attempt 1 to execute request
DEBUG [org.apache.http.impl.conn.DefaultClientConnection] Sending request: GET /newnode?node=/tp HTTP/1.1
DEBUG [org.apache.http.headers] >> GET /newnode?node=/tp HTTP/1.1
DEBUG [org.apache.http.headers] >> Host: localhost
DEBUG [org.apache.http.headers] >> Connection: Keep-Alive
DEBUG [org.apache.http.headers] >> User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
DEBUG [org.apache.http.impl.conn.DefaultClientConnection] Receiving response: HTTP/1.1 200 OK
DEBUG [org.apache.http.headers] << HTTP/1.1 200 OK
DEBUG [org.apache.http.headers] << Transfer-encoding: chunked
DEBUG [org.apache.http.headers] << Content-type: text/html
DEBUG [org.apache.http.headers] << Set-cookie: SESSID=0.9499481656989606; expires=Tue, 19-4-11 18:28:43 GMT; Max-Age=3600; Path=/; Version="1"
DEBUG [org.apache.http.client.protocol.ResponseProcessCookies] Cookie accepted: "[version: 0][name: SESSID][value: 0.9499481656989606][domain: localhost][path: /][expiry: Sun Apr 19 19:28:43 CET 11]". 
DEBUG [org.apache.http.impl.client.DefaultHttpClient] Connection can be kept alive indefinitely
DEBUG [org.apache.http.impl.conn.SingleClientConnManager] Releasing connection org.apache.http.impl.conn.SingleClientConnManager$ConnAdapter@b5f53a

Answer 1

Set-cookie: SESSID=0.9499481656989606; expires=Tue, 19-4-11 18:28:43 GMT; Max-Age=3600; Path=/; Version="1"

cookie 值有多个问题：

(1) 它违反了 RFC 2109 和 RFC 2965 规范，因为它使用带逗号的属性值而不用引号括起来。

(2) expiry 属性看起来很可疑。我怀疑过期日期设置不正确，cookie 只是在它被接受的同一时刻过期。此外，版本 1 cookie（符合 RFC 2109 / RFC 2965）甚至不应该首先使用它。

cookie 还具有Max-Age 属性，较新的 cookie 应该使用，但由于 cookie 格式错误，HttpClient 将 cookie 视为旧的 Netscape 样式之一，Expiry 属性优先于 Max-Age