fix(cookies): use lookahead heuristic for splitting Set-Cookie headers (#8301)

bytaesu · himself65 · commit 8959cb917aee · 2026-03-03T18:28:54.000+09:00
diff --git a/packages/better-auth/src/cookies/cookie-utils.ts b/packages/better-auth/src/cookies/cookie-utils.ts
@@ -27,45 +27,43 @@ export function stripSecureCookiePrefix(cookieName: string): string {
 }
 
 /**
- * Split `Set-Cookie` header, handling commas in `Expires` dates.
+ * Split a comma-joined `Set-Cookie` header string into individual cookies.
  */
 export function splitSetCookieHeader(setCookie: string): string[] {
 	if (!setCookie) return [];
 
 	const result: string[] = [];
-	let current = "";
+	let start = 0;
 	let i = 0;
 
 	while (i < setCookie.length) {
-		const c = setCookie[i];
-
-		if (c === ",") {
-			const lower = current.toLowerCase();
-			if (lower.includes("expires=") && !lower.includes("gmt")) {
-				current += c;
-				i++;
-			} else {
-				const trimmed = current.trim();
-				if (trimmed) {
-					result.push(trimmed);
-				}
-				current = "";
-				i++;
-				if (i < setCookie.length && setCookie[i] === " ") {
-					i++;
-				}
+		if (setCookie[i] === ",") {
+			let j = i + 1;
+			while (j < setCookie.length && setCookie[j] === " ") j++;
+			while (
+				j < setCookie.length &&
+				setCookie[j] !== "=" &&
+				setCookie[j] !== ";" &&
+				setCookie[j] !== ","
+			) {
+				j++;
+			}
+
+			if (j < setCookie.length && setCookie[j] === "=") {
+				const part = setCookie.slice(start, i).trim();
+				if (part) result.push(part);
+				start = i + 1;
+				while (start < setCookie.length && setCookie[start] === " ") start++;
+				i = start;
+				continue;
 			}
-			continue;
 		}
 
-		current += c;
 		i++;
 	}
 
-	const trimmed = current.trim();
-	if (trimmed) {
-		result.push(trimmed);
-	}
+	const last = setCookie.slice(start).trim();
+	if (last) result.push(last);
 
 	return result;
 }
diff --git a/packages/better-auth/src/cookies/cookies.test.ts b/packages/better-auth/src/cookies/cookies.test.ts
@@ -237,6 +237,51 @@ describe("cookie-utils parseSetCookieHeader", () => {
 		expect(map.get("token")?.value).toBe("abc");
 		expect(map.get("token")?.expires).toBeUndefined();
 	});
+
+	it("handles Expires when cookie value contains gmt substring", () => {
+		const map = parseSetCookieHeader(
+			"session_data=testsessiondata; Path=/; Expires=Mon, 02 Mar 2026 05:42:16 GMT; Max-Age=300; Secure; HttpOnly; SameSite=lax",
+		);
+
+		expect(map.get("session_data")?.value).toBe("testsessiondata");
+		expect(map.get("session_data")?.expires).toEqual(
+			new Date("Mon, 02 Mar 2026 05:42:16 GMT"),
+		);
+	});
+
+	it("handles non-standard Expires=0", () => {
+		const map = parseSetCookieHeader("a=1; Expires=0, b=2");
+		expect(map.get("a")?.value).toBe("1");
+		expect(map.get("b")?.value).toBe("2");
+	});
+
+	it("handles RFC 850 date format", () => {
+		const map = parseSetCookieHeader(
+			"a=1; Expires=Sunday, 06-Nov-94 08:49:37 GMT, b=2",
+		);
+		expect(map.get("a")?.value).toBe("1");
+		expect(map.get("b")?.value).toBe("2");
+	});
+
+	it("handles asctime date format (no comma in date)", () => {
+		const map = parseSetCookieHeader(
+			"a=1; Expires=Sun Nov 6 08:49:37 1994, b=2",
+		);
+		expect(map.get("a")?.value).toBe("1");
+		expect(map.get("b")?.value).toBe("2");
+	});
+
+	it("handles mixed cookies with and without Expires", () => {
+		const map = parseSetCookieHeader(
+			"a=1; Path=/; HttpOnly, b=2; Expires=Mon, 01 Jan 2026 00:00:00 GMT; Secure, c=3; SameSite=Lax",
+		);
+		expect(map.get("a")?.value).toBe("1");
+		expect(map.get("b")?.value).toBe("2");
+		expect(map.get("b")?.expires).toEqual(
+			new Date("Mon, 01 Jan 2026 00:00:00 GMT"),
+		);
+		expect(map.get("c")?.value).toBe("3");
+	});
 });
 
 describe("cookie-utils stripSecureCookiePrefix", () => {
