romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 20:33:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookies: leave secure cookies alone

Browse source 
Only allow secure origins to be able to write cookies with the
'secure' flag set. This reduces the risk of non-secure origins
to influence the state of secure origins. This implements IETF
Internet-Draft draft-ietf-httpbis-cookie-alone-01 which updates
RFC6265.

Closes #2956
Reviewed-by: Daniel Stenberg <daniel@haxx.se>
This commit is contained in:
Daniel Gustafsson 2018-12-13 09:57:58 +01:00
parent fdc5563b6e
commit 7a09b52c98
11 changed files with 148 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

86
tests/data/test1561 Normal file
View file

@ -0,0 +1,86 @@
<testcase>
<info>
<keywords>
HTTPS
HTTP
HTTP GET
cookies
cookiejar
HTTP replaced headers
</keywords>
</info>
# Server-side
<reply>
<data1>
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Set-Cookie: super=secret; domain=example.com; path=/1561; secure;
Set-Cookie: supersuper=secret; domain=example.com; path=/1561/login/; secure;
Content-Length: 7
nomnom
</data1>
<data2>
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2010 14:49:00 GMT
Server: test-server/fake
Set-Cookie: super=secret; domain=example.com; path=/1561; httponly;
Set-Cookie: super=secret; domain=example.com; path=/1561/; httponly;
Set-Cookie: super=secret; domain=example.com; path=/15; httponly;
Set-Cookie: public=yes; domain=example.com; path=/foo;
Set-Cookie: supersuper=secret; domain=example.com; path=/1561/login/en;
Set-Cookie: supersuper=secret; domain=example.com; path=/1561/login;
Set-Cookie: secureoverhttp=yes; domain=example.com; path=/1561; secure;
Content-Length: 7
nomnom
</data2>
</reply>
# Client-side
<client>
<features>
SSL
</features>
<server>
http
https
</server>
<name>
HTTP
</name>
<command>
-k https://%HOSTIP:%HTTPSPORT/15610001 -L -c log/jar1561.txt -H "Host: www.example.com" http://%HOSTIP:%HTTPPORT/15610002 -L -c log/jar1561.txt -H "Host: www.example.com"
</command>
</client>
<verify>
<strip>
^User-Agent:.*
</strip>
<protocol>
GET /15610001 HTTP/1.1
Host: www.example.com
User-Agent: curl/7.62.0-DEV
Accept: */*
GET /15610002 HTTP/1.1
Host: www.example.com
User-Agent: curl/7.62.0-DEV
Accept: */*
</protocol>
<file name="log/jar1561.txt" mode="text">
# Netscape HTTP Cookie File
# https://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.
.example.com TRUE /foo FALSE 0 public yes
.example.com TRUE /1561/login/ TRUE 0 supersuper secret
#HttpOnly_.example.com TRUE /15 FALSE 0 super secret
</file>
</verify>
</testcase>