<testcase>
<info>
<keywords>
HTTPS
HTTP
HTTP GET
cookies
cookiejar
HTTP replaced headers
</keywords>
</info>

# Server-side
<reply>
<data1>
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Set-Cookie: super=secret; domain=example.com; path=/%TESTNUMBER; secure;
Set-Cookie: supersuper=secret; domain=example.com; path=/%TESTNUMBER/login/; secure;
Set-Cookie: __Secure-SID=12345; Domain=example.com
Set-Cookie: __Secure-SID=12346; Secure; Domain=example.com
Set-Cookie: supersupersuper=secret; __Secure-SID=12346; Secure; Domain=example.com
Set-Cookie: __Host-SID=22345
Set-Cookie: __Host-SID=22346; Secure
Set-Cookie: __Host-SID=22347; Domain=example.com
Set-Cookie: __Host-SID=22348; Domain=example.com; Path=/
Set-Cookie: __Host-SID=22349; Secure; Domain=example.com; Path=/
Set-Cookie: __Host-SID=12346; Secure; Path=/
Content-Length: 7

nomnom
</data1>
<data2>
HTTP/1.1 200 OK
Date: Tue, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Set-Cookie: super=secret; domain=example.com; path=/%TESTNUMBER; httponly;
Set-Cookie: super=secret; domain=example.com; path=/%TESTNUMBER/; httponly;
Set-Cookie: super=secret; domain=example.com; path=/15; httponly;
Set-Cookie: public=yes; domain=example.com; path=/foo;
Set-Cookie: supersuper=secret; domain=example.com; path=/%TESTNUMBER/login/en;
Set-Cookie: supersuper=secret; domain=example.com; path=/%TESTNUMBER/login;
Set-Cookie: secureoverhttp=yes; domain=example.com; path=/%TESTNUMBER; secure;
Set-Cookie: __Secure-SID=22345; Domain=example.com
Set-Cookie: __Secure-SID=22346; Secure; Domain=example.com
Set-Cookie: __Host-SID=32345
Set-Cookie: __Host-SID=32346; Secure
Set-Cookie: __Host-SID=32347; Domain=example.com
Set-Cookie: __Host-SID=32348; Domain=example.com; Path=/
Set-Cookie: __Host-SID=32349; Secure; Domain=example.com; Path=/
Set-Cookie: __Host-SID=32350; Secure; Path=/
Content-Length: 7

nomnom
</data2>
</reply>

# Client-side
<client>
<features>
SSL
</features>
<server>
http
https
</server>
<killserver>
https
</killserver>
<name>
Cookies set over HTTP can't override secure ones
</name>
<command>
-k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER0001 -L -c log/jar%TESTNUMBER.txt -H "Host: www.example.com"  http://%HOSTIP:%HTTPPORT/%TESTNUMBER0002 -L -c log/jar%TESTNUMBER.txt -H "Host: www.example.com"
</command>
</client>
<verify>
<protocol>
GET /%TESTNUMBER0001 HTTP/1.1
Host: www.example.com
User-Agent: curl/%VERSION
Accept: */*

GET /%TESTNUMBER0002 HTTP/1.1
Host: www.example.com
User-Agent: curl/%VERSION
Accept: */*

</protocol>
<file name="log/jar%TESTNUMBER.txt" mode="text">
# Netscape HTTP Cookie File
# https://curl.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

.example.com	TRUE	/foo	FALSE	0	public	yes
www.example.com	FALSE	/	TRUE	0	__Host-SID	12346
.example.com	TRUE	/	TRUE	0	supersupersuper	secret
.example.com	TRUE	/	TRUE	0	__Secure-SID	12346
.example.com	TRUE	/%TESTNUMBER/login/	TRUE	0	supersuper	secret
#HttpOnly_.example.com	TRUE	/15	FALSE	0	super	secret
</file>

</verify>

</testcase>