romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-04 11:56:14 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookies: leave secure cookies alone

Browse source 
Only allow secure origins to be able to write cookies with the
'secure' flag set. This reduces the risk of non-secure origins
to influence the state of secure origins. This implements IETF
Internet-Draft draft-ietf-httpbis-cookie-alone-01 which updates
RFC6265.

Closes #2956
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
This commit is contained in:
Daniel Gustafsson 2018-12-13 09:57:58 +01:00
parent fdc5563b6e
commit 7a09b52c98
11 changed files with 148 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/HTTP-COOKIES.md
View file

@ -18,7 +18,9 @@
original [Netscape spec from 1994](https://curl.haxx.se/rfc/cookie_spec.html).
In 2011, [RFC6265](https://www.ietf.org/rfc/rfc6265.txt) was finally
published and details how cookies work within HTTP.
published and details how cookies work within HTTP. In 2017, an update was
[drafted](https://tools.ietf.org/html/draft-ietf-httpbis-cookie-alone-01)
to deprecate modification of 'secure' cookies from non-secure origins.
## Cookies saved to disk

8
docs/TODO
View file

@ -73,7 +73,6 @@
5.5 auth= in URLs
5.6 Refuse "downgrade" redirects
5.7 QUIC
5.8 Leave secure cookies alone
6. TELNET
6.1 ditch stdin
@ -605,13 +604,6 @@
implemented. This, to allow other projects to benefit from the work and to
thus broaden the interest and chance of others to participate.
5.8 Leave secure cookies alone
Non-secure origins (HTTP sites) should not be allowed to set or modify
cookies with the 'secure' property:
https://tools.ietf.org/html/draft-ietf-httpbis-cookie-alone-01
6. TELNET