Scope cookies to the host that set them - #2075
Open
rzo1 wants to merge 1 commit into
Open
Conversation
CookieConverter only checked the domain when the cookie carried a Domain attribute, so a cookie without one was sent to any target URL, a single label Domain such as "com" matched every host under it, and checkDomainMatchToUrl returned true when it threw. getCookies now takes the originating URL, keeps a cookie without a Domain attribute for that host only, rejects single label domains and fails closed on error. Behaviour change: the protocol does not record the host that set a cookie, so it passes no origin and cookies without a Domain attribute are no longer sent. The metadata.transfer example in internals.adoc named set-cookie instead of protocol.set-cookie and is corrected too.
rzo1
force-pushed
the
fix/cookie-host-scope
branch
from
August 27, 2026 12:51
25836d6 to
fd5035f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CookieConverteronly checked applicability for cookies carrying aDomainattribute. A cookie without one, which is the usual session cookie, skipped the check and was sent to whatever host was being fetched. The domain check also passed on exception and accepted a single-labelDomainsuch ascom.A three-argument
getCookiestaking the originating host is added and both protocol implementations use it. Neither records the host whose response set the cookie, so they pass null for now and a cookie that cannot be scoped is dropped rather than sent: withhttp.use.cookiesenabled, host-only cookies stop going out until that host is recorded at fetch time. The two-argument method is deprecated and kept. Also corrects themetadata.transferexample ininternals.adoc, which namedset-cookiewhere the key isprotocol.set-cookie.For all changes
Is there a issue associated with this PR? Is it referenced in the commit message? - no issue
Does your PR title start with
#XXXXwhereXXXXis the issue number you are trying to resolve? - no issueHas your PR been rebased against the latest commit within the target branch (typically main)?
Is your initial contribution a single, squashed commit?
Is the code properly formatted with
mvn git-code-format:format-code -Dgcf.globPattern="**/*" -Dskip.format.code=false?For code changes
mvn clean verify? -coremodule tests onlyCookieConverterTestextended