Fix ZonePathContextRewritingFilter rewriting __Host- cookie paths

[joemahady-comm]

RFC 6265bis requires __Host- prefixed cookies to unconditionally have Path=/. The ZonePathContextRewritingFilter was incorrectly mutating the path of these cookies to the zone context path (e.g. /auth), causing browsers to reject them and resulting in CSRF token mismatch errors.

This change updates the filter to exclude __Host- prefixed cookies from path rewriting, ensuring they retain their required Path=/ attribute.

[joemahady-comm]

Issue reproduced:

/uaa path incorrectly set:

_Host-X-Uaa-Csrf=РiYRIET5anaSЗЗdLLcNU4D; Expires=Tue, 25 Aug 2026 08:28:08 GMT; Max-Age=86400; Path=/uaa; Secure; HttpOnly;

Issue fixed:

/ path now correctly set:

_Host-X-Uaa-Csrf=HgiqY4zO\WrTOwYAe3HgFV; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; Secure; HttpOnly; SameSite=Lax

[Copilot]

Pull request overview

This PR fixes zone-path cookie rewriting for __Host--prefixed cookies in ZonePathContextRewritingFilter, aligning behavior with RFC 6265bis by ensuring these cookies keep Path=/ and aren’t rejected by browsers (avoiding downstream CSRF token mismatches).

Changes:

• Skip cookie path rewriting for __Host- cookies when adding Cookie objects to the response.
• Skip Set-Cookie header path rewriting for __Host- cookie names.
• Add regression tests covering both addCookie(...) and addHeader("Set-Cookie", ...) cases for __Host- cookies.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
server/src/main/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilter.java	Excludes __Host- cookies from path rewriting for both Cookie objects and Set-Cookie headers.
server/src/test/java/org/cloudfoundry/identity/uaa/zone/ZonePathContextRewritingFilterTests.java	Adds regression tests to ensure __Host- cookie paths remain / under zone-path requests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[joemahady-comm]

Requesting review from @strehle @duanemay @fhanik