Fails to parse cookie if it has % in its name

[t-ae]

Vapor cannot parse the cookies that has % in its name.
(Similar issue: #2359)

According to RFC6265 cookie-name = <token, defined in [RFC2616], Section 2.2>.
And accodging to RFC2616:

token          = 1*<any CHAR except CTLs or separators>
CHAR           = <any US-ASCII character (octets 0 - 127)>
CTL            = <any US-ASCII control character
                        (octets 0 - 31) and DEL (127)>
separators     = "(" | ")" | "<" | ">" | "@"
                | "," | ";" | ":" | "\" | <">
                | "/" | "[" | "]" | "?" | "="
                | "{" | "}" | SP | HT

If I understand correctly, % is valid.

firstParameterToken tries to find = to separate cookie name and value.
But it fails when it find character that is !character.isDirectiveKey.

vapor/Sources/Vapor/HTTP/Headers/HTTPHeaders+Directive.swift

Lines 133 to 143 in 45d19c3

	private func firstParameterToken() -> Substring.Index? {
	for index in self.current.indices {
	let character = self.current[index]
	if character == .equals {
	return index
	} else if !character.isDirectiveKey {
	return nil
	}
	}
	return nil
	}

And % is not isDirectiveKey.

vapor/Sources/Vapor/HTTP/Headers/HTTPHeaders+Directive.swift

Lines 249 to 251 in 45d19c3

	var isDirectiveKey: Bool {
	self.isLetter || self.isNumber || self == .dash || self == .underscore || self == .period
	}

Steps to reproduce

Open developer tool and create new cookie that has % in its name.
You'll find request.cookies.all is empty.

My problem

My site is mysite.example.com and example.com is not under my control.
When user access to example.com, it sets the cookie some%40key=value and Domain=.example.com (%40 is url encoded @).
This cookie also affects my site.

HTTPCookies.init returns nil if there's invalid directive.

vapor/Sources/Vapor/HTTP/Headers/HTTPCookies.swift

Lines 241 to 249 in 45d19c3

	init?(directives: [HTTPHeaders.Directive]) {
	self.cookies = [:]
	for directive in directives {
	guard let value = directive.parameter else {
	return nil
	}
	self.cookies[.init(directive.value)] = .init(string: .init(value))
	}
	}

So % cookie breaks all other cookies.
(I think this initializer should just ignore invalid directives)

[gregoryyoung2]

I'm experiencing the same issue!