Join repeated HTTP/1 Cookie lines with "; " (#1386)

* Join repeated HTTP/1 Cookie lines with "; "

_read_headers folded a repeated Cookie line into the previous one with
the appendheader comma, so cookies(req) read Cookie: a=1 and Cookie: b=2
as the single cookie a="1,b=2". Join them with "; " as the HTTP/2
server already does.

* Join repeated Cookie values with "; " in appendheader

appendheader merged a repeated header into the previous entry with a
comma and exempted only Set-Cookie. A Cookie header has no comma list
syntax (RFC 6265 5.4 joins pairs with "; "), so every path that builds
headers through appendheader produced a cookie the server reads as one
pair: Headers(["Cookie" => "a=1", "Cookie" => "b=2"]), mkheaders,
append!, and HTTP.get(url, ["Cookie" => "a=1", "Cookie" => "b=2"]),
which sent Cookie: a="1,b=2". Join Cookie values with "; " there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Join received header lines in one pass

Every receive path joined a repeated field line onto the previous entry
with appendheader, which rebuilds the growing value on each line. A peer
that repeats a name made that quadratic: on HTTP/1 a request made of
1 MiB of repeated header lines took about 2.8 s and 16 GiB of
allocation to parse, and the HTTP/2 client, which accepts 10 MiB header
lists, scaled the same way.

The HTTP/1 parser, the HTTP/2 request validator and the HTTP/2 response
header and trailer decoders now store each line as it arrives and join
the section once with _fold_received_fields!, which keeps appendheader's
result and joins every Cookie line into the first with "; " as the
HTTP/2 server did. That also fixes an empty Cookie line followed by
another one: HTTP/1 stored ",b=2", which cookies(req) could not parse,
where HTTP/2 stored "b=2".

The same 1 MiB request now parses in about 0.04 s and 40 MiB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Cover consecutive repeats in the fold tests and update a Cookie comment

The HTTP/1 allocation test alternated X-A and Cookie lines, which master
never joined, so it guarded only the global Cookie join. Add a run of
consecutive X-A lines, the shape master parsed in quadratic time, and
check the HTTP/2 trailer decoder the same way as the response decoder.
Move the Cookie appendheader checks into their own testset, and drop the
addcookie! comment that still said appendheader joins with a comma.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Jacob Quinn <quinn.jacobd@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: 3 people

CHANGELOG.md

@@ -164,6 +164,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   comma, so two adjacent calls produced `Cookie: a=1,b=2`. `cookies(::Request)`
   splits a `Cookie` header on `;` only, so that header parsed back as the single
   cookie `a="1,b=2"` and the second cookie was lost.
+- The HTTP/1 parser now joins every `Cookie` line of a request into one
+  `Cookie` header with `"; "`, as the HTTP/2 server does. Adjacent lines were
+  joined with a comma, so `Cookie: a=1` followed by `Cookie: b=2` was read by
+  `cookies(::Request)` as the single cookie `a="1,b=2"`. ([#1386])
+- `appendheader` now joins repeated `Cookie` values with `"; "` instead of a
+  comma, so `HTTP.get(url, ["Cookie" => "a=1", "Cookie" => "b=2"])` sends
+  `Cookie: a=1; b=2` rather than the single cookie `a="1,b=2"`. ([#1386])
+- Received header sections are joined in linear time. Joining each repeated
+  line onto the previous one rebuilt the growing value, so an HTTP/1 request
+  made of 1 MiB of repeated header lines took about 3 s and 16 GiB of
+  allocation to parse; HTTP/2 request and response headers scaled the same
+  way. ([#1386])
 
 ## [v2.0.0] - 2026-04-27
 HTTP.jl 2.0 is a major rewrite of the package internals and public API. The
@@ -985,3 +997,4 @@ See changes for 0.9.15: this release is equivalent to 0.9.15 with [#752] reverte
 [#1362]: https://github.com/JuliaWeb/HTTP.jl/issues/1362
 [#1371]: https://github.com/JuliaWeb/HTTP.jl/issues/1371
 [#1377]: https://github.com/JuliaWeb/HTTP.jl/issues/1377
+[#1386]: https://github.com/JuliaWeb/HTTP.jl/issues/1386

src/http1.jl

@@ -169,6 +169,9 @@ function _upcoming_header_keys(io::IO)::Int
     return 0
 end
 
+# Framing and Host lines stay separate so their checks see every line.
+_h1_separate_field(key::String)::Bool = key == "Content-Length" || key == "Transfer-Encoding" || key == "Host"
+
 function _read_headers(io::IO, max_line_bytes::Integer, max_header_bytes::Integer)::Headers
     max_header_bytes <= 0 && throw(ArgumentError("max_header_bytes must be > 0"))
     headers = Headers(_upcoming_header_keys(io))
@@ -177,7 +180,7 @@ function _read_headers(io::IO, max_line_bytes::Integer, max_header_bytes::Intege
         line = _readline_crlf(io, max_line_bytes)
         consumed += ncodeunits(line) + 2
         consumed > max_header_bytes && throw(ProtocolError("HTTP/1 headers exceed configured max_header_bytes", _PROTOCOL_ERROR_HEADERS_TOO_LARGE))
-        isempty(line) && return headers
+        isempty(line) && return _fold_received_fields!(headers, _h1_separate_field)
         sep = findfirst(':', line)
         sep === nothing && throw(ParseError("malformed HTTP/1 header line (missing ':'): $(repr(line))"))
         key = String(SubString(line, firstindex(line), prevind(line, sep)))
@@ -186,12 +189,7 @@ function _read_headers(io::IO, max_line_bytes::Integer, max_header_bytes::Intege
         value = _trim_http_ows(SubString(line, nextind(line, sep), lastindex(line)))
         normalized = _normalize_header_field_value(value)
         normalized === nothing && throw(ParseError("invalid HTTP/1 header field value for $(repr(key))"))
-        canon_key = canonical_header_key(key)
-        if canon_key == "Content-Length" || canon_key == "Transfer-Encoding" || canon_key == "Host"
-            push!(headers, canon_key => normalized)
-        else
-            appendheader(headers, canon_key, normalized)
-        end
+        push!(headers, canonical_header_key(key) => normalized)
     end
 end
 

src/http2_client.jl

@@ -1651,10 +1651,10 @@ function _decode_response_headers(headers::Vector{HeaderField})::Tuple{Int,Heade
         if _is_h2_connection_specific_header(name) || name == "transfer-encoding" || name == "te"
             throw(ProtocolError("forbidden HTTP/2 response header $(repr(name))"))
         end
-        appendheader(out, canonical_header_key(name), normalized)
+        push!(out, canonical_header_key(name) => normalized)
     end
     status === nothing && throw(ProtocolError("missing HTTP/2 :status pseudo-header"))
-    return status::Int, out
+    return status::Int, _fold_received_fields!(out)
 end
 
 function _decode_h2_trailer_headers(headers::Vector{HeaderField})::Headers
@@ -1667,9 +1667,9 @@ function _decode_h2_trailer_headers(headers::Vector{HeaderField})::Headers
         _valid_trailer_header_name(name) || throw(ProtocolError("invalid HTTP/2 trailer header $(repr(name))"))
         normalized = _normalize_strict_header_field_value(value)
         normalized === nothing && throw(ProtocolError("invalid HTTP/2 trailer field value for $(repr(name))"))
-        appendheader(out, canonical_header_key(name), normalized)
+        push!(out, canonical_header_key(name) => normalized)
     end
-    return out
+    return _fold_received_fields!(out)
 end
 
 function _publish_h2_response_trailers!(state::H2StreamState)

src/http2_server.jl

@@ -974,16 +974,9 @@ function _validate_h2_request_headers!(headers::Vector{HeaderField})::Tuple{Stri
         if name == "te"
             lowercase(_trim_http_ows(normalized)) == "trailers" || throw(ProtocolError("HTTP/2 TE header may only contain trailers"))
         end
-        if name == "cookie"
-            if hasheader(out_headers, "Cookie")
-                setheader(out_headers, "Cookie", string(header(out_headers, "Cookie"), "; ", normalized))
-            else
-                setheader(out_headers, "Cookie", normalized)
-            end
-            continue
-        end
-        appendheader(out_headers, canonical_header_key(name), normalized)
+        push!(out_headers, canonical_header_key(name) => normalized)
     end
+    _fold_received_fields!(out_headers)
     method === nothing && throw(ProtocolError("missing HTTP/2 :method pseudo-header"))
     # RFC 9113 8.3.1: "If the :authority pseudo-header field is present, the
     # endpoint MUST NOT generate a request with a Host header field that differs

src/http_cookies.jl

@@ -191,7 +191,7 @@ slot.
 function addcookie! end
 
 function addcookie!(r::Request, c::Cookie)
-    # one Cookie header, pairs joined with "; " (RFC 6265 5.4); appendheader would join with ","
+    # one Cookie header holding every stored pair, joined with "; " (RFC 6265 5.4)
     setheader(r.headers, "Cookie" => stringify(join(headers(r.headers, "Cookie"), "; "), [c]))
     return r
 end

src/http_core.jl

@@ -951,8 +951,9 @@ Append a header value to `headers`.
 
 If the previous stored header has the same name (in any case) and the key is
 not `Set-Cookie`, the value is merged into the previous entry, which keeps its
-spelling, with a comma (no whitespace), as permitted by RFC 9110 §5.3 and
-required by common request-signing canonicalizations.
+spelling. `Cookie` values are joined with `"; "` (RFC 6265 §5.4); other values
+with a comma and no whitespace, as permitted by RFC 9110 §5.3 and required by
+common request-signing canonicalizations.
 Otherwise a new pair is appended. [`appendheader!`](@ref) is the same
 function under the conventional mutating-name spelling.
 """
@@ -961,7 +962,8 @@ function appendheader(headers::Headers, header::Pair)
     if !isempty(headers.entries)
         last_header = headers.entries[end]
         if !_ascii_equal_fold(first(item), "Set-Cookie") && _ascii_equal_fold(first(last_header), first(item))
-            headers.entries[end] = first(last_header) => string(last(last_header), ",", last(item))
+            sep = _ascii_equal_fold(first(item), "Cookie") ? "; " : ","
+            headers.entries[end] = first(last_header) => string(last(last_header), sep, last(item))
             return headers
         end
     end
@@ -973,6 +975,61 @@ function appendheader(headers::Headers, key::AbstractString, value::AbstractStri
     return appendheader(headers, key => value)
 end
 
+"""
+    _fold_received_fields!(headers, separate=Returns(false)) -> headers
+
+Join a received header section stored one entry per line, in one pass: a line
+with the same name as the entry kept before it is joined onto that entry with a
+comma, as `appendheader` does, and every `Cookie` line onto the first `Cookie`
+entry with `"; "` (RFC 6265 §5.4). `Set-Cookie` lines and names for which
+`separate` returns true stay separate. Each joined value is built once, so
+repeated names cost linear rather than quadratic time.
+"""
+function _fold_received_fields!(headers::Headers, separate::F=Returns(false)) where {F}
+    entries = headers.entries
+    out = 0
+    run = nothing     # the value of entries[out] and the values joined onto it
+    cookie_at = 0
+    cookie = nothing  # the joined Cookie value, from the second Cookie line on
+    for i in eachindex(entries)
+        key, value = entries[i]
+        if _ascii_equal_fold(key, "Cookie") && cookie_at > 0
+            if cookie === nothing
+                cookie = IOBuffer()
+                write(cookie, last(entries[cookie_at]))
+            end
+            # no separator while the joined value is still empty
+            position(cookie) > 0 && write(cookie, "; ")
+            write(cookie, value)
+            continue
+        end
+        if out > 0 && _ascii_equal_fold(first(entries[out]), key) &&
+           !_ascii_equal_fold(key, "Set-Cookie") && !separate(key)
+            if run === nothing
+                run = IOBuffer()
+                write(run, last(entries[out]))
+            end
+            write(run, ',', value)
+            continue
+        end
+        _store_run!(entries, out, run)
+        run = nothing
+        out += 1
+        entries[out] = entries[i]
+        _ascii_equal_fold(key, "Cookie") && (cookie_at = out)
+    end
+    _store_run!(entries, out, run)
+    cookie === nothing || (entries[cookie_at] = first(entries[cookie_at]) => String(take!(cookie)))
+    resize!(entries, out)
+    return headers
+end
+
+@inline function _store_run!(entries::Vector{Pair{String,String}}, out::Int, run::Union{Nothing,IOBuffer})::Nothing
+    run === nothing && return nothing
+    entries[out] = first(entries[out]) => String(take!(run))
+    return nothing
+end
+
 """
     removeheader(headers, key) -> Headers
 

test/http1_wire_tests.jl

@@ -88,6 +88,30 @@ end
     @test take!(partial_io) == collect(codeunits("cdef"))
 end
 
+@testset "HTTP/1 request parse combines cookie lines with semicolons" begin
+    raw = "GET / HTTP/1.1\r\nHost: example.com\r\nCookie: a=1\r\nX-Test: one\r\nCookie: b=2\r\nCookie: c=3\r\n\r\n"
+    req = HT.read_request(IOBuffer(codeunits(raw)))
+    @test HT.headers(req.headers, "Cookie") == ["a=1; b=2; c=3"]
+    @test [(c.name, c.value) for c in HT.Cookies.cookies(req)] == [("a", "1"), ("b", "2"), ("c", "3")]
+    raw = "GET / HTTP/1.1\r\nHost: example.com\r\nCookie: \r\nCookie: b=2\r\n\r\n"
+    req = HT.read_request(IOBuffer(codeunits(raw)))
+    @test HT.headers(req.headers, "Cookie") == ["b=2"]
+end
+
+@testset "HTTP/1 header parse joins repeated lines in one pass" begin
+    raw = "GET / HTTP/1.1\r\nHost: x\r\nCookie: a=1\r\nX-A: 1\r\nCookie: b=2\r\nX-A: 2\r\nx-a: 3\r\n" *
+          "Set-Cookie: s=1\r\nSet-Cookie: s=2\r\n\r\n"
+    req = HT.read_request(IOBuffer(codeunits(raw)))
+    @test collect(req.headers) == ["Host" => "x", "Cookie" => "a=1; b=2", "X-A" => "1,2,3",
+                                   "Set-Cookie" => "s=1", "Set-Cookie" => "s=2"]
+    repeated_lines(n) = codeunits("GET / HTTP/1.1\r\nHost: x\r\n" * "X-A: a\r\n"^n * "X-B: b\r\nCookie: c\r\n"^n * "\r\n")
+    readreq(bytes) = HT.read_request(IOBuffer(bytes))
+    small, large = repeated_lines(4_000), repeated_lines(8_000)
+    readreq(small); readreq(large)
+    # twice the repeated lines must cost about twice as much, not four times
+    @test @allocated(readreq(large)) < 3 * @allocated(readreq(small))
+end
+
 @testset "HTTP/1 header serialization preserves stored entries" begin
     headers = HT.Headers()
     push!(headers, "X-Test" => "one")

test/http2_client_tests.jl

@@ -215,6 +215,22 @@ end
     @test collect(trailers) == ["Grpc-Status" => "0"]
 end
 
+@testset "HTTP/2 client joins repeated response fields in one pass" begin
+    response_fields(n) = vcat(HT.HeaderField[HT.HeaderField(":status", "200", false)],
+                              [HT.HeaderField("x-a", "a", false) for _ in 1:n])
+    _, headers = HT._decode_response_headers(response_fields(3))
+    @test collect(headers) == ["X-A" => "a,a,a"]
+    trailer_fields = [HT.HeaderField("x-a", "a", false) for _ in 1:3]
+    @test collect(HT._decode_h2_trailer_headers(trailer_fields)) == ["X-A" => "a,a,a"]
+    small, large = response_fields(10_000), response_fields(20_000)
+    HT._decode_response_headers(small); HT._decode_response_headers(large)
+    # twice the repeated fields must cost about twice as much, not four times
+    @test @allocated(HT._decode_response_headers(large)) < 3 * @allocated(HT._decode_response_headers(small))
+    small, large = small[2:end], large[2:end]
+    HT._decode_h2_trailer_headers(small); HT._decode_h2_trailer_headers(large)
+    @test @allocated(HT._decode_h2_trailer_headers(large)) < 3 * @allocated(HT._decode_h2_trailer_headers(small))
+end
+
 @testset "HTTP/2 client validates response pseudo-headers" begin
     @test_throws HT.ProtocolError HT._decode_response_headers(HT.HeaderField[])
     @test_throws HT.ProtocolError HT._decode_response_headers(HT.HeaderField[

test/http2_server_tests.jl

@@ -1418,6 +1418,21 @@ end
     @test HT.header(headers, "Cookie") == "a=1; b=2"
 end
 
+@testset "HTTP/2 server joins repeated request fields in one pass" begin
+    request_fields(n) = vcat(HT.HeaderField[
+            HT.HeaderField(":method", "GET", false),
+            HT.HeaderField(":scheme", "http", false),
+            HT.HeaderField(":authority", "example.test", false),
+            HT.HeaderField(":path", "/", false),
+        ], [HT.HeaderField(isodd(i) ? "cookie" : "x-a", "a", false) for i in 1:n])
+    _, _, _, _, headers = HT._validate_h2_request_headers!(request_fields(4))
+    @test collect(headers) == ["Cookie" => "a; a", "X-A" => "a,a"]
+    small, large = request_fields(10_000), request_fields(20_000)
+    HT._validate_h2_request_headers!(small); HT._validate_h2_request_headers!(large)
+    # twice the repeated fields must cost about twice as much, not four times
+    @test @allocated(HT._validate_h2_request_headers!(large)) < 3 * @allocated(HT._validate_h2_request_headers!(small))
+end
+
 @testset "HTTP/2 server stores request header names in canonical form" begin
     fields = HT.HeaderField[
         HT.HeaderField(":method", "GET", false),

test/http_core_tests.jl

@@ -188,6 +188,15 @@ end
     @test collect(cookies) == ["Set-Cookie" => "a=1", "Set-Cookie" => "b=2"]
 end
 
+@testset "appendheader joins Cookie values with a semicolon (RFC 6265 §5.4)" begin
+    cookie = HT.Headers()
+    HT.appendheader(cookie, "Cookie", "a=1")
+    HT.appendheader(cookie, "cookie", "b=2")
+    @test collect(cookie) == ["Cookie" => "a=1; b=2"]
+    request = HT.Request("GET", "/"; headers = ["Cookie" => "a=1", "Cookie" => "b=2"])
+    @test [(c.name, c.value) for c in HT.Cookies.cookies(request)] == [("a", "1"), ("b", "2")]
+end
+
 @testset "Tuple header collections" begin
     for items in ((), ("x-a" => "one",), ("x-a" => "one", "x-b" => "two"),
                   ("x-a" => "one", "x-b" => "two", "x-c" => "three"),