From d9b13eebc8699e16f204613882ee9a18b3f9bff2 Mon Sep 17 00:00:00 2001
From: reesporte <45641995+reesporte@users.noreply.github.com>
Date: Tue, 24 May 2022 21:45:33 -0500
Subject: [PATCH] Recognize semi-colon separated cookies too (#2078)

This fixes a bug where the frontend UI sends GRPC cookies via a single semi-colon
separated string, which our new token parsing algorithm did not recognize as valid.
Now we account for that special case, at the small expense of greater overall
computational complexity.
---
 server/grpc.go               | 19 +++++++++++--------
 server/grpc_internal_test.go | 11 +++++++++++
 2 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/server/grpc.go b/server/grpc.go
index cad41bc4f..451817e58 100644
--- a/server/grpc.go
+++ b/server/grpc.go
@@ -1730,14 +1730,17 @@ func getTokensFromMetadata(md metadata.MD) (string, string) {
 
 	if !ok || !ok2 {
 		if cookies, there := md["cookie"]; there {
-			for _, cookie := range cookies {
-				if strings.HasPrefix(cookie, authn.AccessCookieName+"=") && len(access) == 0 {
-					access = strings.Split(cookie, authn.AccessCookieName+"=")[1:]
-				} else if strings.HasPrefix(cookie, authn.RefreshCookieName+"=") && len(refresh) == 0 {
-					refresh = strings.Split(cookie, authn.RefreshCookieName+"=")[1:]
-				}
-				if len(access) > 0 && len(refresh) > 0 {
-					break
+			for _, c := range cookies {
+				for _, cookie := range strings.Split(c, ";") {
+					cookie = strings.TrimSpace(cookie)
+					if strings.HasPrefix(cookie, authn.AccessCookieName+"=") && len(access) == 0 {
+						access = strings.Split(cookie, authn.AccessCookieName+"=")[1:]
+					} else if strings.HasPrefix(cookie, authn.RefreshCookieName+"=") && len(refresh) == 0 {
+						refresh = strings.Split(cookie, authn.RefreshCookieName+"=")[1:]
+					}
+					if len(access) > 0 && len(refresh) > 0 {
+						break
+					}
 				}
 			}
 		}
diff --git a/server/grpc_internal_test.go b/server/grpc_internal_test.go
index 024664a13..bb98bd4f9 100644
--- a/server/grpc_internal_test.go
+++ b/server/grpc_internal_test.go
@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"fmt"
 	"strings"
 	"testing"
 
@@ -46,6 +47,16 @@ func TestGetTokensFromMetadata(t *testing.T) {
 				},
 			},
 		},
+		"semiColonCookies": {
+			access:    "something",
+			refresh:   "somethingElse",
+			setCookie: false,
+			md: metadata.MD{
+				"cookie": []string{
+					fmt.Sprintf("%s=something; %s=somethingElse", authn.AccessCookieName, authn.RefreshCookieName),
+				},
+			},
+		},
 		"inTheHeaderNoRefresh": {
 			access:  "something",
 			refresh: "",