java - 为什么 cURL 不将 cookie 的过期/最大年龄值发送回服务器？

Question

我正在使用 Java 中的 Netty.io 框架构建服务器，但在验证请求时遇到问题。

在验证请求时，我尝试通过检查 sessionId 及其过期来验证它。

if (sessionId == correctSessionId && expiry < currentTime) {
   // then mark the request as authenticated.
} 

但是每当我向服务器发送请求时(在我登录并收到适当的带有到期日的cookie之后)，服务器端没有收到到期/最大年龄。我做错了什么？

Curl 登录请求:

curl -b cookies.txt -c cookies.txt -POST http://localhost:8080/api/v1/account/login -H 'content-type: application/json' -d '{"mobile": "123", "password": "123"}' -v

输出:

*   Trying ::1...
* Connected to localhost (::1) port 8080 (#0)
> POST /api/v1/account/login HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.43.0
> Accept: */*
> content-type: application/json
> Content-Length: 36
>
* upload completely sent off: 36 out of 36 bytes
< HTTP/1.1 200 OK
* Replaced cookie sessionId="efB9DYHl46aARJMtW59fSKuf+wVtpZ0Y0eveJiLMLH+lEBfvHjzaow==" for domain localhost, path /api/v1/account/, expire 1469968200
< Set-Cookie: sessionId=efB9DYHl46aARJMtW59fSKuf+wVtpZ0Y0eveJiLMLH+lEBfvHjzaow==; Max-Age=180; Expires=Sun, 31 Jul 2016 12:30:00 GMT
* no chunk, no close, no size. Assume close to signal end
<
* Closing connection 0
{"id":"579d3d9902dd1134817edefc","name":"admin","mobile":"123","email":null,"audit":{"createdTime":1469922712940,"createdBy":null,"modifiedTime":1469922712940,"modifiedBy":null}}

Notice Set-cookie header and it's expiry date. Server sends it correctly.

Cookies.txt 文件:

# Netscape HTTP Cookie File
# http://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

localhost FALSE /api/v1/account/  FALSE 1469968200  sessionId efB9DYHl46aARJMtW59fSKuf+wVtpZ0Y0eveJiLMLH+lEBfvHjzaow==

cookies.text also stores the values correctly.

访问需要身份验证的资源的 Curl 请求:

curl -c cookies.txt -b cookies.txt -XGET http://localhost:8080/api/v1/account/details -H 'content-type: application/json' -v

它的输出:

*   Trying ::1...
* Connected to localhost (::1) port 8080 (#0)
> GET /api/v1/account/details HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.43.0
> Accept: */*
> Cookie: sessionId=efB9DYHl46aARJMtW59fSKuf+wVtpZ0Y0eveJiLMLH+lEBfvHjzaow==
> content-type: application/json
>
< HTTP/1.1 401 Unauthorized
* no chunk, no close, no size. Assume close to signal end
<
* Closing connection 0
Session Unauthorized. Please login%

SessionId is sent but no expiry or max-age. Why ?

我错过了什么？

Answer 1

curl 不会发回该信息，因为它遵循 HTTP cookie 协议(protocol)(请参阅 RFC6265 )，并且它表示客户端应该仅为每个 cookie 发送 name=val 。过期时间和其他元数据由服务器发送并由客户端处理，但它们永远不会发回。