Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix parsing cookie Domain attribute with leading dot #11098

Conversation

mamantoha
Copy link
Contributor

Domain with leading dot (e.g. .example.com) breaks cookies parser.

Code to reproduce the issue:

cookie = "foo=bar; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.example.com; SameSite=None; secure; HttpOnly"

puts HTTP::Cookie::Parser.parse_set_cookie(cookie).inspect

Before:

#<HTTP::Cookie:0x7fce81225ee0 @name="foo", @value="bar", @path="/", @expires=1970-01-01 00:00:01.0 UTC, @domain=nil, @secure=false, @http_only=false, @samesite=nil, @extension="domain=.example.com; SameSite=None; secure; HttpOnly">

After:

#<HTTP::Cookie:0x7f09a3b29ee0 @name="foo", @value="bar", @path="/", @expires=1970-01-01 00:00:01.0 UTC, @domain="example.com", @secure=true, @http_only=true, @samesite=None, @extension=nil>

According to RFC 6265 section 4.1.2.3

(Note that a leading %x2E ("."), if present,
is ignored even though that character is not permitted, but a
trailing %x2E ("."), if present, will cause the user agent to ignore
the attribute.) If the server omits the Domain attribute, the user
agent will return the cookie only to the origin server.

Copy link
Member

@sdogruyol sdogruyol left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @mamantoha 🙏

@straight-shoota straight-shoota added this to the 1.2.0 milestone Aug 30, 2021
@straight-shoota straight-shoota merged commit 7239bf1 into crystal-lang:master Sep 1, 2021
@mamantoha mamantoha deleted the fix-cookies-domain-with-leading-dot branch October 25, 2022 13:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants