Expired cookies trigger auth token intercept

[bcbee]

Hey There!

I was creating Phishlets and noticed that the site was using an anti-pattern cookie clear pattern where they would set the cookie to be expired, but they also set the value to INVALID instead of "". This results in the all authorization tokens intercepted! and redirect prematurely.

Is there any objection to ignoring expired cookies when evaluating whether an auth token has been captured? Maybe we could make this a setting if there is a case where this is intended behavior (can't think of one).

Thanks!
Brendan

[kgretzky]

Thanks for the PR! I will look into that. At first glance the fix looks good.

[bcbee]

Hey @kgretzky, just checking in on this one. Is the PR I submitted good to go?