Fix ZonePathContextRewritingFilter rewriting __Host- cookie paths

RFC 6265bis requires `__Host-` prefixed cookies to unconditionally have `Path=/`.
The `ZonePathContextRewritingFilter` was incorrectly mutating the path of these
cookies to the zone context path (e.g. `/auth`), causing browsers to reject them
and resulting in CSRF token mismatch errors.

This change updates the filter to exclude `__Host-` prefixed cookies from path
rewriting, ensuring they retain their required `Path=/` attribute.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java

@@ -316,6 +316,9 @@ public void setHeader(String name, String value) {
         }
 
         private boolean shouldRewritePath(String name, String path) {
+            if (name != null && name.startsWith("__Host-")) {
+                return false;
+            }
             if (ignoreCookies.contains(name)) {
                 return false;
             }
@@ -351,7 +354,7 @@ private String rewriteSetCookieHeaderValue(String headerValue) {
                 return headerValue;
             }
             String cookieName = extractCookieNameFromSetCookieHeader(headerValue);
-            if (cookieName != null && ignoreCookies.contains(cookieName)) {
+            if (cookieName != null && (cookieName.startsWith("__Host-") || ignoreCookies.contains(cookieName))) {
                 return headerValue;
             }
             String pathToUse = originalContextPath;

server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java

@@ -459,6 +459,23 @@ void cookieWithPathNull_whenZonePathRewritten_rewritesToOriginalContextPath() th
         assertThat(cookies[0].getPath()).isEqualTo("/uaa");
     }
 
+    @Test
+    void addCookie_hostPrefixedCookie_leavesPathUnchanged() throws Exception {
+        request.setContextPath("/uaa");
+        request.setRequestURI("/uaa/z/myzone/login");
+
+        FilterChain chain = (_, res) -> {
+            Cookie c = new Cookie("__Host-X-Uaa-Csrf", "v");
+            c.setPath("/");
+            ((HttpServletResponse) res).addCookie(c);
+        };
+        filter.doFilter(request, response, chain);
+
+        Cookie[] cookies = response.getCookies();
+        assertThat(cookies).hasSize(1);
+        assertThat(cookies[0].getPath()).isEqualTo("/");
+    }
+
     @Test
     void noZonePath_withContextPath_rewritesCookiePathToContextPath() throws Exception {
         request.setContextPath("/uaa");
@@ -596,10 +613,26 @@ void addHeaderSetCookie_ignoredCookieName_leavesPathUnchanged() throws Exception
 
         String header = response.getHeader("Set-Cookie");
         assertThat(header)
-                .contains("Path=/")
+                .contains("Path=/;")
+                .doesNotContain("Path=/uaa")
                 .contains("Current-User=");
     }
 
+    @Test
+    void addHeaderSetCookie_hostPrefixedCookie_leavesPathUnchanged() throws Exception {
+        request.setContextPath("/uaa");
+        request.setRequestURI("/uaa/z/myzone/login");
+
+        FilterChain chain = (_, res) -> ((HttpServletResponse) res).addHeader("Set-Cookie", "__Host-X-Uaa-Csrf=encoded; Path=/; HttpOnly");
+        filter.doFilter(request, response, chain);
+
+        String header = response.getHeader("Set-Cookie");
+        assertThat(header)
+                .contains("Path=/;")
+                .doesNotContain("Path=/uaa")
+                .contains("__Host-X-Uaa-Csrf=");
+    }
+
     @Test
     void setHeaderSetCookie_ignoredCookieName_leavesPathUnchanged() throws Exception {
         request.setContextPath("/uaa");
@@ -609,7 +642,9 @@ void setHeaderSetCookie_ignoredCookieName_leavesPathUnchanged() throws Exception
         filter.doFilter(request, response, chain);
 
         String header = response.getHeader("Set-Cookie");
-        assertThat(header).contains("Path=/");
+        assertThat(header)
+                .contains("Path=/")
+                .doesNotContain("Path=/uaa");
     }
 
     @Test
@@ -621,7 +656,9 @@ void addHeaderSetCookie_withPathSlash_whenNoContextPath_leavesPathSlash() throws
         filter.doFilter(request, response, chain);
 
         String header = response.getHeader("Set-Cookie");
-        assertThat(header).contains("Path=/");
+        assertThat(header)
+                .contains("Path=/")
+                .doesNotContain("Path=/uaa");
     }
 
     // --- zones.paths.enabled flag ---