IHttpRequest SetHeader does not overwrite the header if the header name is "Cookie"

Version: 4.17.2

Platform Windows 10 x64

I found this bug while using the (Thirdparty) VaRest library, but after walking through the code with the debugger i found out that the bug is not inside of the VaRest code, but instead lies somewhere inside of FCurlHttpRequest (It seems that it happens somewhere in an internal curl function which i do not have the Source/symbols for to debug).

Description: I’m using the Varest library to communicate with my backend api, VaRest is build around IhttpRequest. My aim was to login into my backend and get, save and set the return cookie “Header Set-Cookie” myself, as Unreal forgets the cookie/session once the game exit. While I want to keep the user logged on the next time they start the game.

If you use the set header function of VaRest, it will in turn save your header name and content and will later call the ihttpRequest set header function with the said name and content. The ihttpRequest::SetHeader has the description “SetHeader for a given HeaderName will overwrite any previous values”, overall this seems correct. However if you try to set the “Cookie” header, then instead of overwriting the Cookie header it will actually append my cookie header content to the cookie that is cached by curl itself.

Repro Steps:
I could put VaRest here, but because its thirdparty you will probably don’t want that (if not so, please say, so I can give you a clear repro for VaRest).
The quickest way to replicate it for a programmer would be to do IhttpRequest call to server which returns a cookie with the “set-cookie” header. Afterwhich you call IhttpRequest::SetHeader with “Cookie” “TestCookie”, and do another get call and look at the final Http Header “Cookie” output of the request (I look at the headers i receive on my backend).

Unanswered question #2832342.