Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RFC6265bis: Prevent nameless cookies with prefixed values #2251

Merged
merged 3 commits into from
Oct 18, 2022
Merged

RFC6265bis: Prevent nameless cookies with prefixed values #2251

merged 3 commits into from
Oct 18, 2022

Conversation

sbingler
Copy link
Collaborator

Modify the cookie storage algorithm to reject cookies that:

  • Do not have a name
  • Have values that look like cookie prefixes

As mentioned in #2229, malicious servers can exploit nameless cookies to impersonate prefix'd cookies.

mikewest
mikewest approved these changes Sep 22, 2022
View reviewed changes
Copy link
Member

@mikewest mikewest left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given that we accept nameless cookies, this looks like a reasonable approach to me. We would ideally figure out how to stop accepting nameless cookies, but that's a larger effort. :)

Do we have tests for this behavior in WPT?

@sbingler
Copy link
Collaborator Author

Do we have tests for this behavior in WPT?

Good question, no not yet. I'll add some.

@sbingler
Copy link
Collaborator Author

sbingler commented Oct 5, 2022

Done

@sbingler
Copy link
Collaborator Author

Ping @mikewest

@mikewest mikewest merged commit fb17121 into httpwg:main Oct 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mikewest mikewest mikewest approved these changes

@chlily1 chlily1 Awaiting requested review from chlily1

@johnwilander johnwilander Awaiting requested review from johnwilander johnwilander is a code owner

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@sbingler @mikewest