Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clear Cookie header when redirect to cross-site #3417

Closed
wants to merge 4 commits into from

Conversation

Projects
None yet
3 participants
@kyoshidajp
Copy link
Contributor

commented Dec 30, 2018

After version 7.58.0, Authorization header isn't forward to cross-site when redirect.

Cookie header with confidential data should also be supported.

@bagder

This comment has been minimized.

Copy link
Member

commented Dec 30, 2018

I don't think this makes a lot of sense. Cookies already have a domain match logic to make them only get sent to the relevant hosts and are very frequently used across different names. Can you expand on exactly which use case or problem this would work for?

@kyoshidajp

This comment has been minimized.

Copy link
Contributor Author

commented Dec 30, 2018

Thanks.

The case is Cookie header is specified directly instead of -b/cookie option with cookie file. For example, http://example.jp is original target URL, and http://example.com is redirected URL (may be under attack like domain hijacking).

When I try to run the following command, Cookie header was forward to http://example.com.

curl -H "Cookie: xxx" --verbose -L http://example.jp/

There is no problem when -b option is used like:

curl -b cookie.txt --verbose -L http://example.jp/
@bagder

This comment has been minimized.

Copy link
Member

commented Jan 4, 2019

Ah right. I suppose this is sensible. The only little detail I miss here is a mention about this in the CURLOPT_HTTPHEADER.3 man page in the similar style the Authorization: restriction is!

@kyoshidajp

This comment has been minimized.

Copy link
Contributor Author

commented Jan 5, 2019

@bagder So, should I add the following sentence under https://github.com/curl/curl/blob/master/docs/libcurl/opts/CURLOPT_HTTPHEADER.3#L87-L89 ?

Starting in 7.64.0, libcurl will specifically prevent "Cookie:" headers
from being sent to other hosts than the first used one, unless specifically
permitted with the \fBCURLOPT_UNRESTRICTED_AUTH(3)\fP option.
@bagder

This comment has been minimized.

Copy link
Member

commented Jan 7, 2019

should I add the following sentence

Yes please!

@danielgustafsson
Copy link
Member

left a comment

LGTM

<info>
<keywords>
HTTP
followlocation

This comment has been minimized.

Copy link
@danielgustafsson

danielgustafsson Jan 7, 2019

Member

Should we have "cookies" here?

This comment has been minimized.

Copy link
@kyoshidajp

kyoshidajp Jan 9, 2019

Author Contributor

Thanks. I did.

kyoshidajp added some commits Jan 7, 2019

@bagder

This comment has been minimized.

Copy link
Member

commented Jan 9, 2019

Thanks!

@bagder bagder closed this in 1f30dc8 Jan 9, 2019

@kyoshidajp kyoshidajp deleted the kyoshidajp:clear_cookie_when_redirect branch Jan 10, 2019

@lock lock bot locked as resolved and limited conversation to collaborators Apr 10, 2019

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
You can’t perform that action at this time.