ResponseCookie was changed and now applies Rfc6265Utils to validate attributes. As stated on issue #23776, we should be strict with output and lenient with input. Reality is that ReactorClientHttpResponse and JettyClientHttpResponse are using ResponseCookie to propagate cookies received. This scenario is cleary input and yet it's still failing when hitting endpoints behind Cloudflare, as they add the HttpOnly cookie with domain=.domain.com as stated here.
Regarding possible solutions, I think the builder itself could have some kind of flag to disable validation, allowing both ReactorClientHttpResponse and JettyClientHttpResponse use it when just propagating cookies from the cookie header.
ResponseCookiewas changed and now applies Rfc6265Utils to validate attributes. As stated on issue #23776, we should be strict with output and lenient with input. Reality is thatReactorClientHttpResponseandJettyClientHttpResponseare usingResponseCookieto propagate cookies received. This scenario is cleary input and yet it's still failing when hitting endpoints behind Cloudflare, as they add the HttpOnly cookie withdomain=.domain.comas stated here.Regarding possible solutions, I think the builder itself could have some kind of flag to disable validation, allowing both
ReactorClientHttpResponseandJettyClientHttpResponseuse it when just propagating cookies from the cookie header.