-
-
Notifications
You must be signed in to change notification settings - Fork 9.7k
Description
The BrowserKit/CookieJar
code uses exact domain and path matches to store and retrieve cookies:
$this->cookieJar[$domain][$path][$name]
This utterly fails the requirements of RFC 6265 for matching domains:
For example, if the value of the Domain attribute is "example.com", the user agent will include the cookie in the Cookie header when making HTTP requests to example.com, www.example.com, and www.corp.example.com.
If you load any google resource you'll receive a cookie with domain=.google.com
. According to the RFC this cookie should match any domain ending in .google.com as well as google.com itself.
Similar problems exist with path matching where leading and trailing slashes figure in to whether or not a cookie matches what's stored in the CookieJar
. From the relevant RFC section:
The user agent will include the cookie in an HTTP request only if the path portion of the request-uri matches (or is a subdirectory of) the cookie's Path attribute, where the %x2F ("/") character is interpreted as a directory separator.
Exact path matches aren't sufficient -- subdirectory paths should also be matched.