{"action":"created","issue":{"url":"https://api.github.com/repos/hapijs/hapi/issues/2957","labels_url":"https://api.github.com/repos/hapijs/hapi/issues/2957/labels{/name}","comments_url":"https://api.github.com/repos/hapijs/hapi/issues/2957/comments","events_url":"https://api.github.com/repos/hapijs/hapi/issues/2957/events","html_url":"https://github.com/hapijs/hapi/issues/2957","id":118796372,"number":2957,"title":"nameless cookie causing hapi fail parsing","user":{"login":"davidhouweling","id":9696959,"avatar_url":"https://avatars.githubusercontent.com/u/9696959?v=3","gravatar_id":"","url":"https://api.github.com/users/davidhouweling","html_url":"https://github.com/davidhouweling","followers_url":"https://api.github.com/users/davidhouweling/followers","following_url":"https://api.github.com/users/davidhouweling/following{/other_user}","gists_url":"https://api.github.com/users/davidhouweling/gists{/gist_id}","starred_url":"https://api.github.com/users/davidhouweling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidhouweling/subscriptions","organizations_url":"https://api.github.com/users/davidhouweling/orgs","repos_url":"https://api.github.com/users/davidhouweling/repos","events_url":"https://api.github.com/users/davidhouweling/events{/privacy}","received_events_url":"https://api.github.com/users/davidhouweling/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-11-25T09:39:32Z","updated_at":"2015-11-26T03:22:09Z","closed_at":null,"body":"I know that cookies should always have a name, but i stumbled across an issue where something injected a nameless cookie into my code (probably a third party library). But as a result, it causes the request.state to equal null.\r\n\r\nTo test this, host a site using hapi, in Firefox console...\r\n\r\n``` javascript\r\ndocument.cookie='=1'\r\n```\r\n\r\nThen reload the page (i also set my hapi server.route's config.state.failAction to 'log'), and you get the following in the console/terminal\r\n``` console\r\nInternal request error { header: '1', errors: null }\r\n```\r\n\r\nNeeds to be a way to tell hapi to drop any invalid cookies like these.\r\n\r\nI'm presently using hapi version 9.0.3, so i understand it is a little out of date.\r\n\r\nLet me know if this has been fixed in a later version. If so i will look to upgrading."},"comment":{"url":"https://api.github.com/repos/hapijs/hapi/issues/comments/159792449","html_url":"https://github.com/hapijs/hapi/issues/2957#issuecomment-159792449","issue_url":"https://api.github.com/repos/hapijs/hapi/issues/2957","id":159792449,"user":{"login":"davidhouweling","id":9696959,"avatar_url":"https://avatars.githubusercontent.com/u/9696959?v=3","gravatar_id":"","url":"https://api.github.com/users/davidhouweling","html_url":"https://github.com/davidhouweling","followers_url":"https://api.github.com/users/davidhouweling/followers","following_url":"https://api.github.com/users/davidhouweling/following{/other_user}","gists_url":"https://api.github.com/users/davidhouweling/gists{/gist_id}","starred_url":"https://api.github.com/users/davidhouweling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidhouweling/subscriptions","organizations_url":"https://api.github.com/users/davidhouweling/orgs","repos_url":"https://api.github.com/users/davidhouweling/repos","events_url":"https://api.github.com/users/davidhouweling/events{/privacy}","received_events_url":"https://api.github.com/users/davidhouweling/received_events","type":"User","site_admin":false},"created_at":"2015-11-26T03:22:09Z","updated_at":"2015-11-26T03:22:09Z","body":"Unfortunately no luck. This is a stripped down version of my setup.\r\n\r\n``` javascript\r\nconst server = new Hapi.Server({\r\n  connections: {\r\n    state: {\r\n      strictHeader: false\r\n    }\r\n  }\r\n});\r\nserver.on('request-internal', (request, event, tags) => {\r\n  if (tags.error && tags.state) {\r\n    console.error('Internal request error', event.data);\r\n    server.methods.log.error(event.data);\r\n  }\r\n});\r\n````\r\n\r\nand inside `server.register`\r\n``` javascript\r\n  server.route({\r\n    method  : 'GET',\r\n    path    : '/',\r\n    handler : (request, response) => {\r\n      console.log(request.state); // this will result in null\r\n    },\r\n    config: {\r\n      state: {\r\n        failAction: 'log'\r\n      }\r\n    }\r\n  });\r\n```\r\n\r\nStill yields in the same result. \r\n\r\n``` console\r\nInternal request error { header: '1', errors: null }\r\nnull\r\n```"}}