diff --git a/CHANGELOG.md b/CHANGELOG.md index d73e1d5a..aace3390 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ - [Request] Treat IPv6 literals as non-domain hosts. - [Router] Fall back to `SERVER_NAME` when deriving exact host constraints. - [Cookies] Use request host fallback when resolving cookie domains. +- [Cookies] Match array-based cookie domains case-insensitively. ## [1.25.1] - 2026-06-08 diff --git a/lib/rage/cookies.rb b/lib/rage/cookies.rb index ff2a773c..2a0e702a 100644 --- a/lib/rage/cookies.rb +++ b/lib/rage/cookies.rb @@ -208,7 +208,7 @@ def []=(key, value) elsif domain == :all DomainName(host).domain elsif domain.is_a?(Array) - host if domain.include?(host) + domain.find { |candidate| candidate.casecmp?(host) } if host end end diff --git a/spec/controller/api/cookies_spec.rb b/spec/controller/api/cookies_spec.rb index 459be4e2..0facdf1a 100644 --- a/spec/controller/api/cookies_spec.rb +++ b/spec/controller/api/cookies_spec.rb @@ -310,6 +310,32 @@ end end + context "when request host uses different casing" do + let(:request_host) { "COOKIE.TEST.COM" } + + it "correctly sets domain value" do + subject.cookies[:user_id] = { + domain: %w(api.test.com cookie.test.com), + value: 120 + } + + expect(response_cookies[:user_id]).to eq("120; domain=cookie.test.com") + end + end + + context "when request host uses different casing and includes a port" do + let(:request_host) { "COOKIE.TEST.COM:3000" } + + it "correctly sets domain value" do + subject.cookies[:user_id] = { + domain: %w(api.test.com cookie.test.com), + value: 120 + } + + expect(response_cookies[:user_id]).to eq("120; domain=cookie.test.com") + end + end + context "when request uses SERVER_NAME fallback" do let(:request_env) do {