romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 20:53:54 +03:00
Code Issues Projects Releases Packages Wiki Activity

docs: clarify that cookies need domain set to match

Browse source 
Especially important if reading cookies from HTTP headers, which is a
style we discourage.

Reported-by: accl on hackerone
Closes #22621
This commit is contained in:
Daniel Stenberg 2026-08-19 09:03:41 +02:00
parent 695aa15743
commit fc6c67ce86
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 12 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/cmdline-opts/cookie.md
View file

@ -42,15 +42,16 @@ If the filename is an empty string ("") and is the only cookie input, curl
activates the cookie engine without any cookies.
The file format of the file to read cookies from should be plain HTTP headers
(Set-Cookie style) or the Netscape/Mozilla cookie file format.
(Set-Cookie style) or the Netscape/Mozilla cookie file format. We discourage
the use of the HTTP header style.
The file specified with --cookie is only used as input. No cookies are written
to that file. To store cookies, use the --cookie-jar option.
If you use the Set-Cookie file format and do not specify a domain then the
cookie is not sent since the domain never matches. To address this, set a
domain in Set-Cookie line (doing that includes subdomains) or preferably: use
the Netscape format.
If you read cookies from a plain HTTP headers file, make sure each
`Set-Cookie` line specifies a `Domain` attribute. Without an explicit domain,
the cookie cannot be reliably matched to a target host and may be applied in
unexpected ways. We suggest using the Netscape file format instead.
Users often want to both read cookies from a file and write updated cookies
back to a file, so using both --cookie and --cookie-jar in the same command

13
docs/libcurl/opts/CURLOPT_COOKIEFILE.md
View file

@ -39,14 +39,13 @@ By passing the empty string ("") to this option, you enable the cookie engine
without reading any initial cookies. If you tell libcurl the filename is "-"
(a single minus sign), libcurl instead reads from stdin.
This option only **reads** cookies. To make libcurl write cookies to file,
see CURLOPT_COOKIEJAR(3).
This option only **reads** cookies. To make libcurl write cookies to file, see
CURLOPT_COOKIEJAR(3).
If you read cookies from a plain HTTP headers file and it does not specify a
domain in the Set-Cookie line, then the cookie is not sent since the cookie
domain cannot match the target URL's. To address this, set a domain in
Set-Cookie line (doing that includes subdomains) or preferably: use the
Netscape format.
If you read cookies from a plain HTTP headers file, make sure each
`Set-Cookie` line specifies a `Domain` attribute. Without an explicit domain,
libcurl cannot reliably associate the cookie with a host and it may be applied
in unexpected ways. We suggest using the Netscape file format instead.
The application does not have to keep the string around after setting this
option.