romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 14:57:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

cookie: update the comment on cookie length and size limits

Browse source 
To refer to the proper cookie RFC and the upcoming RFC refresh.

Closes #11127
This commit is contained in:
Daniel Stenberg 2023-05-17 16:12:48 +02:00
parent f1e5d8a731
commit d334b02924
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 20 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

34
lib/cookie.h
View file

@ -69,23 +69,34 @@ struct CookieInfo {
curl_off_t next_expiration; /* the next time at which expiration happens */
};
/* This is the maximum line length we accept for a cookie line. RFC 2109
section 6.3 says:
/* The maximum sizes we accept for cookies. RFC 6265 section 6.1 says
"general-use user agents SHOULD provide each of the following minimum
capabilities":
"at least 4096 bytes per cookie (as measured by the size of the characters
that comprise the cookie non-terminal in the syntax description of the
Set-Cookie header)"
We allow max 5000 bytes cookie header. Max 4095 bytes length per cookie
name and value. Name + value may not exceed 4096 bytes.
- At least 4096 bytes per cookie (as measured by the sum of the length of
the cookie's name, value, and attributes).
In the 6265bis draft document section 5.4 it is phrased even stronger: "If
the sum of the lengths of the name string and the value string is more than
4096 octets, abort these steps and ignore the set-cookie-string entirely."
*/
/** Limits for INCOMING cookies **/
/* The longest we allow a line to be when reading a cookie from a HTTP header
or from a cookie jar */
#define MAX_COOKIE_LINE 5000
/* Maximum length of an incoming cookie name or content we deal with. Longer
cookies are ignored. */
#define MAX_NAME 4096
#define MAX_NAME_TXT "4095"
/* Maximum number of Set-Cookie: lines accepted in a single response. If more
such header lines are received, they are ignored. This value must be less
than 256 since an unsigned char is used to count. */
#define MAX_SET_COOKIE_AMOUNT 50
/** Limits for OUTGOING cookies **/
/* Maximum size for an outgoing cookie line libcurl will use in an http
request. This is the default maximum length used in some versions of Apache
@ -97,11 +108,6 @@ struct CookieInfo {
keep the maximum HTTP request within the maximum allowed size. */
#define MAX_COOKIE_SEND_AMOUNT 150
/* Maximum number of Set-Cookie: lines accepted in a single response. If more
such header lines are received, they are ignored. This value must be less
than 256 since an unsigned char is used to count. */
#define MAX_SET_COOKIE_AMOUNT 50
struct Curl_easy;
/*
* Add a cookie to the internal list of cookies. The domain and path arguments