fix: join multiple Cookie header values with '; ' instead of ',' (#521)

[Yusufihsangorgel]

Fixes #521.

When a message carries multiple Cookie header values, the single-value
headers map joins them with a comma:

final request = Request('GET', Uri.parse('http://localhost/'), headers: {
  'Cookie': ['session=123', 'theme=dark'],
});
print(request.headers['cookie']); // session=123,theme=dark

The cookie-string grammar of RFC 6265 separates cookie-pairs with ; and
does not allow commas, so the joined value is unparseable by servers and
middleware that read request.headers['cookie']. This also happens on the
real server path: dart:io delivers repeated Cookie lines as separate
list entries, which shelf_io passes through to headersAll, and the
headers view then comma-joins them.

The joining happens in joinHeaderValues in lib/src/util.dart, which
uses , unconditionally. Comma is correct for every header except
Cookie; RFC 9113 section 8.2.3 specifies that split cookie fields must
be recombined with the two-octet delimiter ; .

This change gives joinHeaderValues an optional name parameter and uses
; when the name is cookie (case-insensitive). Headers.singleValues
and findHeader pass the header name through. The two remaining call
sites in message.dart join content-type and transfer-encoding and
are unchanged. headersAll is unaffected.

After the change the example above prints session=123; theme=dark, and
the same is true end to end for a request sent over a socket with two
Cookie lines.

Added a test in message_test.dart next to the existing multi-value
header test; it fails with session=123,theme=dark before the fix. The
existing "headers with multiple values" test guards that non-cookie
headers still join with a comma. The full pkgs/shelf suite passes
(231 tests), and dart analyze and dart format are clean.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request updates the header joining logic to join multiple 'Cookie' request-header values with '; ' instead of ',' in the single-value headers map, adhering to RFC 6265 section 5.4. This is implemented by passing the header name to joinHeaderValues and conditionally using '; ' as the separator when the header name is 'cookie'. A unit test has been added to verify this behavior. There are no review comments, so I have no feedback to provide.

[kevmoo]

I see tests! I see changelog entries! Amazing! Thank you! Will wait for a "real engineer" to review - @brianquinlan

[Yusufihsangorgel]

Thanks, Kevin — appreciate it. Happy to address anything that comes up in Brian's review.

[brianquinlan]

Per https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.1 must literal semicolons in cookie-value be replaced with %3B

Is that escaping done at another level?

[Yusufihsangorgel]

Yes — that escaping (when it happens at all) is done by whoever writes the cookie, not at this layer. RFC 6265 doesn't actually mandate %3B or any specific escape: the cookie-octet grammar in §4.1.1 excludes ; entirely, and its guidance for servers that want to store such data is that they "SHOULD encode that data, for example, using Base64" at Set-Cookie time. The user agent sends the encoded form back untouched, so in a conforming request ; only ever appears between cookie-pairs (cookie-string = cookie-pair *( ";" SP cookie-pair ), section 4.2.1), which is what keeps the RFC 9113 section 8.2.3 recombination this PR performs unambiguous. shelf keeps treating the values as opaque strings and adds or removes no encoding, same as before this change. A raw ; inside a value would already be indistinguishable from a pair boundary within a single Cookie line, so the join doesn't create a new case.

[brianquinlan]

Thank you very much for the PR!

[Yusufihsangorgel]

Thanks for the review and the merge, Brian.