From 455f1e6ba078749ded5f70fb62d6fbf4eed84b17 Mon Sep 17 00:00:00 2001
From: Wleeaf <179125857+wleeaf@users.noreply.github.com>
Date: Mon, 26 Oct 2026 07:07:08 +0000
Subject: [PATCH] fix: skip Set-Cookie headers without a cookie in
 hackney:cookies/1

hackney:cookies/1 crashed with a case_clause error when a Set-Cookie
value parsed to no cookie at all: an empty value, one holding only
separators, or a single $-prefixed name. Such headers are now skipped.
---
 src/hackney.erl               | 4 +++-
 test/hackney_cookie_tests.erl | 9 +++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/hackney.erl b/src/hackney.erl
index 72488748..f40f58ef 100644
--- a/src/hackney.erl
+++ b/src/hackney.erl
@@ -1345,7 +1345,9 @@ cookies(Headers) ->
                       case hackney_cookie:parse_cookie(V) of
                         {error, _} -> Acc;
                         [{Name, _} | _]=Cookie ->
-                          [{Name, Cookie} | Acc]
+                          [{Name, Cookie} | Acc];
+                        %% An empty Set-Cookie value holds no cookie.
+                        [] -> Acc
                       end;
                     _ ->
                       Acc
diff --git a/test/hackney_cookie_tests.erl b/test/hackney_cookie_tests.erl
index 9053fbb8..7e23abf5 100644
--- a/test/hackney_cookie_tests.erl
+++ b/test/hackney_cookie_tests.erl
@@ -42,6 +42,15 @@ parse_cookie_test_() ->
             ],
     [{V, ?_assertEqual(R, hackney_cookie:parse_cookie(V))} || {V, R} <- Tests].
 
+cookies_test_() ->
+    %% Set-Cookie headers that hold no cookie are skipped.
+    Headers = [{<<"Set-Cookie">>, <<>>},
+               {<<"Set-Cookie">>, <<" ; ">>},
+               {<<"Set-Cookie">>, <<"$Version=1">>},
+               {<<"Set-Cookie">>, <<"k1=v1; Path=/">>}],
+    ?_assertEqual([{<<"k1">>, [{<<"k1">>, <<"v1">>}, {<<"Path">>, <<"/">>}]}],
+                  hackney:cookies(Headers)).
+
 setcookie_test_() ->
     %% {Name, Value, Opts, Result}
     Tests = [