A dysfunctional session cookie is created in integration tests when any other cookie is created in the same request

This applies to 2.3.8 and also the current 2-3-stable branch.

Look into actionpack/lib/action_controller/session/abstract_store.rb, around line 204:

unless headers[SET_COOKIE].blank?

headers[SET_COOKIE] << "\n#{cookie}"

else

headers[SET_COOKIE] = cookie

end

The \n causes a dysfunctional session cookie to be created during integration tests every time when any other cookie is written (i.e. when the array headers[SET_COOKIE] is not empty).

This can cause sessions to be broken in integration tests.

The problem does not affect production use, probably because \n is interpreted differently by the browsers.

Such behavior was introduced with the commit 524d8edf68ab94315a128cbd7570d1cf4faf7d7a by Joshua Peek in Feb 08 2009, titled "Update bundled Rack for Ruby 1.9 spec changes".

How to reproduce:

in pages_controller.rb:

def test

logger.debug "REQUEST: cookies: #{cookies.inspect}"
cookies[:foo] = "bar"

end

in session_test.rb:

require 'test_helper'

class SessionCookieTest < ActionController::IntegrationTest

def test_login_and_browse_site

get "/pages/test"
get "/pages/test"

end end

Run it and observe the following inside test.log:

REQUEST: cookies: {}
REQUEST: cookies: {"\n_session_id"=>"66f367a068d1b76e4c5316186c8c6036", "foo"=>"bar"}

This is, my friend, a broken session.