From 3beb292f4f954ae3c39104ce12f1a9f033845867 Mon Sep 17 00:00:00 2001
From: Gerasimos Maropoulos <makis@ideopod.com>
Date: Tue, 16 Aug 2016 19:23:12 +0300
Subject: [PATCH] Fix https://github.com/kataras/iris/issues/351

---
 context.go  | 34 +++++++++++++++++++++++++---------
 sessions.go |  4 ++--
 2 files changed, 27 insertions(+), 11 deletions(-)

diff --git a/context.go b/context.go
index f75c3f62..f04b552a 100644
--- a/context.go
+++ b/context.go
@@ -794,31 +794,32 @@ func (ctx *Context) SetCookie(cookie *fasthttp.Cookie) {
 
 // SetCookieKV adds a cookie, receives just a key(string) and a value(string)
 func (ctx *Context) SetCookieKV(key, value string) {
-	c := fasthttp.AcquireCookie() // &fasthttp.Cookie{}
+	//c := fasthttp.AcquireCookie()
+	c := &fasthttp.Cookie{}
 	c.SetKey(key)
 	c.SetValue(value)
 	c.SetHTTPOnly(true)
 	c.SetExpire(time.Now().Add(time.Duration(120) * time.Minute))
 	ctx.SetCookie(c)
-	fasthttp.ReleaseCookie(c)
+	//fasthttp.ReleaseCookie(c)
 }
 
 // RemoveCookie deletes a cookie by it's name/key
 func (ctx *Context) RemoveCookie(name string) {
 	ctx.Response.Header.DelCookie(name)
 
-	cookie := fasthttp.AcquireCookie()
+	//	cookie := fasthttp.AcquireCookie()
+	cookie := &fasthttp.Cookie{}
 	cookie.SetKey(name)
 	cookie.SetValue("")
 	cookie.SetPath("/")
 	cookie.SetHTTPOnly(true)
 	exp := time.Now().Add(-time.Duration(1) * time.Minute) //RFC says 1 second, but let's do it 1 minute to make sure is working...
 	cookie.SetExpire(exp)
-	ctx.Response.Header.SetCookie(cookie)
-	fasthttp.ReleaseCookie(cookie)
+	ctx.SetCookie(cookie)
+	//fasthttp.ReleaseCookie(cookie)
 	// delete request's cookie also, which is temporarly available
 	ctx.Request.Header.DelCookie(name)
-
 }
 
 // GetFlashes returns all the flash messages for available for this request
@@ -912,13 +913,28 @@ func (ctx *Context) GetFlash(key string) (string, error) {
 // SetFlash sets a flash message, accepts 2 parameters the key(string) and the value(string)
 // the value will be available on the NEXT request
 func (ctx *Context) SetFlash(key string, value string) {
-	c := fasthttp.AcquireCookie()
-	c.SetKey(flashMessageCookiePrefix + key)
-	c.SetValue(base64.URLEncoding.EncodeToString([]byte(value)))
+	cKey := flashMessageCookiePrefix + key
+	cValue := base64.URLEncoding.EncodeToString([]byte(value))
+	/* see https://github.com/kataras/iris/issues/351
+	c := fasthttp.AcquireCookie() this occurs strange behavior if called inside a handler which ctx.Session() is already called for the first time
+	c.SetKey(cKey)
+	c.SetValue(cValue)
 	c.SetPath("/")
 	c.SetHTTPOnly(true)
 	ctx.RequestCtx.Response.Header.SetCookie(c)
 	fasthttp.ReleaseCookie(c)
+	*/
+	// but this works, and the above:
+	//ctx.RequestCtx.Request.Header.SetCookie(cKey, cValue)
+	//ctx.RequestCtx.Response.Header.Add("Set-Cookie", cKey+"="+cValue+"; Path:/; HttpOnly")
+	//
+	c := &fasthttp.Cookie{}
+	c.SetKey(cKey)
+	c.SetValue(cValue)
+	c.SetPath("/")
+	c.SetHTTPOnly(true)
+	ctx.SetCookie(c)
+
 }
 
 // Session returns the current session
diff --git a/sessions.go b/sessions.go
index 07e4094f..8268db09 100644
--- a/sessions.go
+++ b/sessions.go
@@ -332,7 +332,8 @@ func (m *sessionsManager) start(ctx *Context) *session {
 	if cookieValue == "" { // cookie doesn't exists, let's generate a session and add set a cookie
 		sid := m.generateSessionID()
 		session = m.provider.init(sid)
-		cookie := fasthttp.AcquireCookie()
+		//cookie := fasthttp.AcquireCookie() strange errors when c.SetFlash (old)
+		cookie := &fasthttp.Cookie{}
 		// The RFC makes no mention of encoding url value, so here I think to encode both sessionid key and the value using the safe(to put and to use as cookie) url-encoding
 		cookie.SetKey(m.config.Cookie)
 		cookie.SetValue(sid)
@@ -376,7 +377,6 @@ func (m *sessionsManager) start(ctx *Context) *session {
 		} // if it's -1 then the cookie is deleted when the browser closes
 
 		ctx.SetCookie(cookie)
-		fasthttp.ReleaseCookie(cookie)
 	} else {
 		session = m.provider.read(cookieValue)
 	}