Fix hack on Set-Cookie

This is one that I couldn't figure out for a while.  Turns out that
fields has both a set() and an insert() method.  Whereas set() replaces,
insert() appends, which is what we want in this case.

This allows us to call the actual methods several times, instead of
essentially string injecting our own code, which should make it clearer.

At the same time, there was one unit test that was structured such that
it was using addHeader to clear a header, so this commit adds an
explicit "clearHeader()" method, so we can be explicit.

Tested:
Logging into the webui in chrome (which uses POST /login) shows:
401 with no cookie header if the incorrect password is used
200 with 2 Set-Cookie headers set:
Set-Cookie:
SESSION=<session tag>; SameSite=Strict; Secure; HttpOnly
Set-Cookie:
XSRF-TOKEN=<token tag>; SameSite=Strict; Secure

Change-Id: I9b87a48ea6ba892fc08e66940563dea86edb9a65
Signed-off-by: Ed Tanous <edtanous@google.com>

1 files changed, 7 insertions, 2 deletions

diff --git a/http/http_response.hpp b/http/http_response.hpp
index 1a4ef16d4e..93c90d7d09 100644
--- a/http/http_response.hpp
+++ b/http/http_response.hpp
@@ -29,12 +29,17 @@ struct Response
 
     void addHeader(std::string_view key, std::string_view value)
     {
-        stringResponse->set(key, value);
+        stringResponse->insert(key, value);
     }
 
     void addHeader(boost::beast::http::field key, std::string_view value)
     {
-        stringResponse->set(key, value);
+        stringResponse->insert(key, value);
+    }
+
+    void clearHeader(boost::beast::http::field key)
+    {
+        stringResponse->erase(key);
     }
 
     Response() : stringResponse(response_type{}) {}