Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(security): fix cookies leakage between different users #10

Merged
merged 2 commits into from
Nov 30, 2023

Conversation

WSH032
Copy link
Owner

@WSH032 WSH032 commented Nov 29, 2023

Summary

  • fix security vulnerabilities of cookies leakage between different users

Through this PR, fastapi-proxy-lib takes over the AsyncClient cookies argument.

For example, the following do not work anymore.

ForwardHttpProxy(AsyncClient(cookies={"foo": "bar"}))

But normal cookie sending and receiving are not affected.

Security-advisories: GHSA-7vwr-g6pm-9hc8

Checklist

  • I've read CONTRIBUTING.md.
  • I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.

- fix security vulnerabilities of cookies leakage between different users

Security-advisories: GHSA-7vwr-g6pm-9hc8
@WSH032 WSH032 added the bug Something isn't working label Nov 29, 2023
Copy link

codecov bot commented Nov 29, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (5836696) 96.71% compared to head (305a2ca) 96.74%.
Report is 9 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main      #10      +/-   ##
==========================================
+ Coverage   96.71%   96.74%   +0.02%     
==========================================
  Files           9        9              
  Lines         457      461       +4     
  Branches       66       67       +1     
==========================================
+ Hits          442      446       +4     
  Misses          9        9              
  Partials        6        6              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@WSH032 WSH032 merged commit 195d071 into main Nov 30, 2023
21 checks passed
@WSH032 WSH032 deleted the security-fix branch November 30, 2023 15:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant