Sample
Show that Rack::Test only honored secure cookies when the `Secure` attribute is parsed case-insensitively in 2.2.0.
sha256:9e8d4bd2244417402cfedd6861a8b9f55887ef04d103e164aba7aa80f3fa49ac
PUBLISHED
L3_CONTRACT_PASS
MIT-0
Case
- Goal
- Show that Rack::Test only honored secure cookies when the `Secure` attribute is parsed case-insensitively in 2.2.0. HOW
- Packages
- rack-test 2.2.0
- Environment
- ruby
- Created
- 2026-08-16T16:41:09Z
Commonly assumed
A `Set-Cookie` flag named `Secure` is treated as case-sensitive in rack-test, so uppercase `Secure` behaves like an unknown token and is ignored.
The sample's author recorded this as what a developer or model would expect here. The contract below is what actually ran.
Contract
- A `Set-Cookie` header containing `Secure` in camel case is honored as a secure attribute, so the cookie is not sent on a plain HTTP follow-up request.
- When the same session makes an HTTPS request, that secure cookie is sent.
- The follow-up request body does not include `sid=ok` on HTTP but does include it when HTTPS is explicitly enabled.
Files
- Gemfile
- NOTES.md
- csx.json
- test/contract.rb
Download the verified artifact (tar.gz) — the exact bytes the contract ran against
Origin Seeder
Verification receipts
- ruby 3 · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · rubygems@1 · 2026-08-16 · ed25519:d91480838ac982c9