Multiple cookies in Set-Cookie header at one response

[Raz Buchnik]

Context

After signing in, in the mock server, I want to send both Authorization cookie and CSRFToken cookie - at one response.
In addition, I want it also to be stated down that these two cookies will be saved (in the documentation).

Current Behavior

Only the first cookie in the examples array is sent.

Expected Behavior

Multiple cookies should be registered in the mock server, just like any other real server.
Proper documentation should tell about more than one cookie.

Possible Solution(s)

Ability to define multiple cookies in the same header can be done as follows:

examples: ['Authorization: my cookie value here ....', 'CSRFToken: cookie value here']

or,

example: 'Authorization: my cookie here, CSRFToken: my cookie here' // one string

[Chelsea Hohmann]

@razb-viola could you please provide the following:

1. example spec to reproduce the issue
2. command used to start up Prism (i.e. prism mock ...)
3. example request you're sending the mock server to reproduce the issue
4. response gotten from your sample request
5. expected response from your sample request

[Raz Buchnik]

@chohmann this is a typical headers response:

responses:
        "201":
          description: Signed in validated successfully
          headers:
            Set-Cookie:
              schema:
                type: string
                example: Authorization=Bearer token; Path=/; HttpOnly

Now how can I set Refresh token cookie as well? in the same response. I can only send one cookie not multiple.

[Chelsea Hohmann]

@razb-viola we really need all of the information asked for in my previous comment before we can really look into this issue.

Could you please provide the following:

1. FULL example spec to reproduce the issue
2. command used to start up Prism (i.e. prism mock ...)
3. example request you're sending the mock server to reproduce the issue
4. response gotten from your sample request
5. expected response from your sample request

[Raz Buchnik]

@chohmann you ask things that already mentioned here. Could you please just tell me how to set it work the right way instead?

[Kayla Chun]

@razb-viola I'm sorry, but we are unable to proceed without the information requested from @chohmann above. We will be closing this issue out but feel free to open a new issue when you're able to provide that information.

[Raz Buchnik]

Hi guys I am trying to register 2 cookies in the same response header - what actually happens is that only one cookie is registered (the first one but never the second one).

Lets answer your questions one by one:

1. FULL example spec to reproduce the issue
2. command used to start up Prism (i.e. prism mock ...)
3. example request you're sending the mock server to reproduce the issue
4. response gotten from your sample request
5. expected response from your sample request

Answers:

1. What do you mean by full? my OAS spec is around 3k of lines. I have provided the exact part that is relevant. The part that I am sending the 200 status code response with the Set-Cookie header is just the only needed part, believe me. If it helps, I tried both on OpenApi version 3.0 and 3.1. Both didn't work.
2. Just as you said, I use: prism mock ./path/to/oas.yaml
3. The Content-Type header is application/json, but it doesn't matter to mention this, since there is no problem with the request because the first cookie is registered.
4. A traditional Set-Cookie response header BUT with the value of the first cookie only.
5. A traditional Set-Cookie header with the value of BOTH cookies.

**

This is the updated spec, with two cookies but only the accessToken will be saved in the browser's cookies:

responses:
        "201":
          description: Signed in validated successfully
          headers:
            Set-Cookie:
              schema:
                type: string
                examples: 
                - accessToken=token; Path=/; HttpOnly // only this will be registered.
                - refreshToken=token; Path=/; HttpOnly

You know what? leave my issue aside and try by yourself. If you able to send 2 cookies on the same response - just tell me how.

I like prism and I would lovely glad to contribute to this repository as well, but please, bare with me, I provided all you need.

[Chelsea Hohmann]

@razb-viola thank you for providing most of the details we asked for. Prism is designed to only return one example value (either the first or whichever you configure in your request using the prefer header). We think in order to achieve what you're looking for, you'd have to combine both cookie values in one example:

responses:
  "201":
    description: Signed in validated successfully
    headers:
      Set-Cookie:
        schema:
          type: string
          examples: 
          - accessToken=token; Path=/; HttpOnly; refreshToken=token; Path=/; HttpOnly

[Raz Buchnik]

I have tried this and it doesn't work. Only the first cookie will be saved.