Fetch API corrupts repetitive response headers

Description

The Fetch API misinterprets repetitive response headers, for instance, Set-Cookie header passed separately for each cookie. All values of the header concatenate into a single string unusable for further processing.

Reproduction

fetch('https://github.com/facebook/react-native')
    .then((response) => {
        console.log(response.headers);
        console.log(response.headers.getAll('Set-Cookie'));
    });

Expected result:

{ map: 
	   { date: [ 'Fri, 10 Mar 2017 06:53:22 GMT' ],
	     'content-type': [ 'text/html; charset=utf-8' ],
	     'set-cookie': [
                 '_gh_sess=eyJsYXN0...; path=/; secure; HttpOnly',
                 'user_session=AYIZ4afT...; path=/; expires=Fri, 24 Mar 2017 07:18:28 -0000; secure; HttpOnly'
             ]
           }
}

[
    '_gh_sess=eyJsYXN0...; path=/; secure; HttpOnly',
    'user_session=AYIZ4afT...; path=/; expires=Fri, 24 Mar 2017 07:18:28 -0000; secure; HttpOnly'
]

Actual result:

{ map: 
	   { date: [ 'Fri, 10 Mar 2017 06:53:22 GMT' ],
	     'content-type': [ 'text/html; charset=utf-8' ],
	     'set-cookie': [
                 '_gh_sess=eyJsYXN0...; path=/; secure; HttpOnly, user_session=AYIZ4afT...; path=/; expires=Fri, 24 Mar 2017 07:18:28 -0000; secure; HttpOnly'
             ]
           }
}

[
    '_gh_sess=eyJsYXN0...; path=/; secure; HttpOnly, user_session=AYIZ4afT...; path=/; expires=Fri, 24 Mar 2017 07:18:28 -0000; secure; HttpOnly'
]

Solution

The underlying platform-specific code that implements the Fetch API needs to be fixed.

Additional Information

• React Native version: 0.42.0
• Platform: iOS (haven’t tested on Android)
• Operating System: MacOS

[stevef]

This is still an issue and shouldn’t be closed.

[nfriedly]

TL; DR:

I think React Native is more or less doing things correctly here, but it would be nice if it followed the example of Node.js and special-cased Set-Cookie headers as an array field rather than a combined one and/or provided access to the raw headers.

---

Long version with citations:

In reading things this morning, and talking to folks behind the Fetch spec, React Native seems to be following the fetch spec correctly, with the exception of allowing access to Set-Cookie headers at all. (And the second exception of including the now-deprecated Headers.getAll() API; but the value-combining behavior is correct for when it was in the spec).

The header combining behavior is allowed (but not required) according to the HTTP RFC, and also mentioned in the cookie RFC:

An origin server may include multiple Set-Cookie headers in a response. Note that an intervening gateway could fold multiple such headers into a single header.

It can be rather difficult to combine a combined Set-Cookie header since, for example, a expires field can contain the same ", " separator that is used to combine multiple headers into one.

The Fetch spec takes things a step further and requires this combining behavior. Fetch folks are aware that it doesn’t work well for cookies but require the behavior anyways since their spec doesn’t allow access to Set-Cookie headers.

So, as I said above, special-casing cookies and/or providing raw header access would be very beneficial here.

Looking at the code, that may be easier said then done…

---

Also, regarding this:

React Native also appears to discard cookie path (and perhaps domain) when automatically sending Cookie headers based on the previously received Set-Cookie.

I believe this is the correct behavior. Set-Cookie is allowed to contain that stuff, but not Cookie - it just contains name-value pairs as appropriate for the requested path and domain.