Skip to content

cookie: tailmatch the domains for secure override#21910

Closed
bagder wants to merge 2 commits into
masterfrom
bagder/cookie-domain
Closed

cookie: tailmatch the domains for secure override#21910
bagder wants to merge 2 commits into
masterfrom
bagder/cookie-domain

Conversation

@bagder

@bagder bagder commented Jun 8, 2026

Copy link
Copy Markdown
Member

If a SECURE cookie is set for a sub-domain (example.com) and is then attempted to get set again for more specific part of that domain (www.example.com) without the SECURE property, the second occurance should not be allowed.

Reported-by: Trail of Bits

Verified by test 3305

If a SECURE cookie is set for a sub-domain (`example.com`) and is then
attempted to get set again for more specific part of that domain
(`www.example.com`) without the SECURE property, the second occurance
should not be allowed.

Reported-by: Trail of Bits

Verified by test 3305
@bagder bagder added the cookies label Jun 8, 2026
@github-actions github-actions Bot added the tests label Jun 8, 2026
@bagder bagder marked this pull request as ready for review June 8, 2026 15:19
@bagder bagder requested a review from Copilot June 8, 2026 15:19

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR tightens curl’s cookie handling to prevent a non-secure cookie set for a more specific hostname from overriding (“overlaying”) an existing SECURE cookie set for a broader domain, addressing a security report and adding a regression test.

Changes:

  • Add new test case test3305 to reproduce/verify the secure-cookie override scenario.
  • Register test3305 in the test data Makefile.am.
  • Update lib/cookie.c domain matching used by the secure-overlay prevention logic to use tail-matching.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
tests/data/test3305 Adds a regression test covering secure cookie vs. non-secure attempted override across domain specificity.
tests/data/Makefile.am Includes the new test case in the test suite list.
lib/cookie.c Adjusts domain matching logic involved in preventing non-secure cookies from overlaying existing secure cookies.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread lib/cookie.c
@bagder bagder closed this in e66b81a Jun 9, 2026
@bagder bagder deleted the bagder/cookie-domain branch June 9, 2026 09:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Development

Successfully merging this pull request may close these issues.

2 participants