Skip to content

BrowserKit CookieJar is totally ignorant of RFC 6265 edge cases #8311

@rdlowrey

Description

@rdlowrey

The BrowserKit/CookieJar code uses exact domain and path matches to store and retrieve cookies:

$this->cookieJar[$domain][$path][$name]

This utterly fails the requirements of RFC 6265 for matching domains:

For example, if the value of the Domain attribute is "example.com", the user agent will include the cookie in the Cookie header when making HTTP requests to example.com, www.example.com, and www.corp.example.com.

If you load any google resource you'll receive a cookie with domain=.google.com. According to the RFC this cookie should match any domain ending in .google.com as well as google.com itself.

Similar problems exist with path matching where leading and trailing slashes figure in to whether or not a cookie matches what's stored in the CookieJar. From the relevant RFC section:

The user agent will include the cookie in an HTTP request only if the path portion of the request-uri matches (or is a subdirectory of) the cookie's Path attribute, where the %x2F ("/") character is interpreted as a directory separator.

Exact path matches aren't sufficient -- subdirectory paths should also be matched.

Metadata

Metadata

Assignees

No one assigned

    Labels

    BrowserKitGood first issueIdeal for your first contribution! (some Symfony experience may be required)

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      pFad - Phonifier reborn

      Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

      Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


      Alternative Proxies:

      Alternative Proxy

      pFad Proxy

      pFad v3 Proxy

      pFad v4 Proxy