feat: Flutter SDK update for version 24.1.0#309
Conversation
Greptile SummaryThis PR updates the Flutter SDK to version 24.1.0, adding a
Confidence Score: 3/5The new setCookie() feature in ClientIO can silently conflict with the CookieManager interceptor, meaning forwarded cookies may be dropped or overwritten in a non-empty jar; needs a fix before the server-side cookie forwarding use-case is reliable. The setCookie() method in ClientIO stores the header as 'Cookie' (capitalized) in _headers, while the CookieManager interceptor later writes jar cookies under the lowercase 'cookie' key. dart:io's case-insensitive HttpHeaders collapses these to the same canonical header, and the winning value depends on iteration order. In any session where the cookie jar is non-empty, the manually-forwarded cookie could be lost without any error or warning. lib/src/client_io.dart — the setCookie/CookieManager interaction needs attention before this is shipped. Important Files Changed
Reviews (1): Last reviewed commit: "Commit from GitHub Actions (Format and p..." | Re-trigger Greptile |
| /// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes. | ||
| @override | ||
| ClientIO setCookie(value) { | ||
| config['cookie'] = value; | ||
| addHeader('Cookie', value); | ||
| return this; | ||
| } |
There was a problem hiding this comment.
setCookie conflicts with CookieManager interceptor
addHeader('Cookie', value) stores the manual cookie as the key 'Cookie' in _headers. During call(), the CookieManager interceptor then runs request.headers.addAll({HttpHeaders.cookieHeader: cookie}) (using the lowercase key 'cookie'). Because http.BaseRequest.headers is a case-sensitive Map<String, String>, both entries co-exist, but when IOClient forwards them to dart:io's HttpHeaders.set() — which is case-insensitive — the last write for the canonical cookie header wins. The outcome (which value is kept) depends on iteration order and is non-deterministic across Dart versions. In a non-empty cookie jar scenario the forwarded cookie may be silently dropped or partially overwritten by jar cookies.
| /// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes.. | ||
| Client setCookie(String value); |
There was a problem hiding this comment.
Double period at end of doc comment.
| /// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes.. | |
| Client setCookie(String value); | |
| /// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes. | |
| Client setCookie(String value); |
| /// The user cookie to authenticate with. Used by SDKs that forward an incoming Cookie header in server-side runtimes. | ||
| @override | ||
| ClientBrowser setCookie(value) { | ||
| config['cookie'] = value; | ||
| addHeader('Cookie', value); | ||
| return this; | ||
| } |
There was a problem hiding this comment.
Cookie is a forbidden header in browsers
Cookie is on the Fetch spec's forbidden header list, so browsers silently discard it when sent via fetch or XMLHttpRequest. Calling setCookie() on ClientBrowser will store the value in config but the header will never reach the server. This is likely acceptable since the method is documented as being for server-side runtimes, but a guard or debugPrint warning when this is called in a browser context would prevent silent mis-use.
|
Closing — changes not substantial enough to warrant a release. |
This PR contains updates to the SDK for version 24.1.0.
What's Changed
setCookie()method toClient,ClientIO, andClientBrowserfor forwarding incomingCookieheaders in server-side runtimesfusionauth,keycloak, andkickOAuth providers toOAuthProviderenumX-Appwrite-Response-Formatheader to1.9.4