Fix cookie scoping for HTTPS urls. #343
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If Cookie.port is specified not None then CookieJar will attempt to compare it to the port for the Request object by first parsing it out of `Request.host` and if there is no port specified there falling back to the `DEFAULT_HTTP_PORT` value of 80. This caused cookies to never be sent for HTTPS domains because the Cookie.port was set to 443, and the _FakeUrllib2Request.host did not contain the default port value. I've also added a test to make sure non-default port values work properly.
glyph
approved these changes
Feb 8, 2022
|
@twm if you have a minute to do another fast-following release once this lands that would be great, this is a pretty bad bug in our security fix :-| |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If Cookie.port is specified not None then CookieJar will attempt to
compare it to the port for the Request object by first parsing it out of
Request.hostand if there is no port specified there falling back tothe
DEFAULT_HTTP_PORTvalue of 80.This caused cookies to never be sent for HTTPS domains because the
Cookie.port was set to 443, and the _FakeUrllib2Request.host did not
contain the default port value.
I've also added a test to make sure non-default port values work properly.