fix(cookie): normalize host handling with port (#926)

Author: 0x676e67

src/cookie.rs

@@ -296,7 +296,11 @@ impl Jar {
     {
         let cookie: RawCookie<'static> = cookie.into();
         let uri = into_uri!(uri);
-        let domain = cookie.domain().or_else(|| uri.host()).unwrap_or_default();
+        let domain = cookie
+            .domain()
+            .map(normalize_domain)
+            .or_else(|| uri.host())
+            .unwrap_or_default();
         let path = cookie.path().unwrap_or_else(|| normalize_path(&uri));
 
         let mut inner = self.0.write();
@@ -443,7 +447,7 @@ const DEFAULT_PATH: &str = "/";
 /// - Returns true if the host and domain are identical.
 /// - Returns true if the host is a subdomain of the domain (host ends with ".domain").
 /// - Returns false otherwise.
-pub fn domain_match(host: &str, domain: &str) -> bool {
+fn domain_match(host: &str, domain: &str) -> bool {
     if domain.is_empty() {
         return false;
     }
@@ -463,19 +467,28 @@ pub fn domain_match(host: &str, domain: &str) -> bool {
 ///   - the cookie path ends with '/', or
 ///   - the next character in the request path after the cookie path is '/'.
 /// - Returns false otherwise.
-pub fn path_match(req_path: &str, cookie_path: &str) -> bool {
+fn path_match(req_path: &str, cookie_path: &str) -> bool {
     req_path == cookie_path
         || req_path.starts_with(cookie_path)
             && (cookie_path.ends_with(DEFAULT_PATH)
                 || req_path[cookie_path.len()..].starts_with(DEFAULT_PATH))
 }
 
+/// Normalizes a domain by stripping any port information.
+///
+/// According to [RFC 6265 section 5.2.3](https://datatracker.ietf.org/doc/html/rfc6265#section-5.2.3),
+/// the domain attribute of a cookie must not include a port. If a port is present (non-standard),
+/// it will be ignored for domain matching purposes.
+fn normalize_domain(domain: &str) -> &str {
+    domain.split(':').next().unwrap_or(domain)
+}
+
 /// Computes the normalized default path for a cookie as specified in
 /// [RFC 6265 section 5.1.4](https://datatracker.ietf.org/doc/html/rfc6265#section-5.1.4).
 ///
 /// This function normalizes the path for a cookie, ensuring it matches
 /// browser and server expectations for default cookie scope.
-pub fn normalize_path(uri: &Uri) -> &str {
+fn normalize_path(uri: &Uri) -> &str {
     let path = uri.path();
     if !path.starts_with(DEFAULT_PATH) {
         return DEFAULT_PATH;