Skip to content

set cookie origin in RequestAddCookies when a Cookie header is present - #924

Merged
ok2c merged 2 commits into
apache:masterfrom
Hsnmohd:cookie-origin-stale-context
Nov 6, 2026
Merged

ok2c merged 2 commits into
apache:masterfrom
Hsnmohd:cookie-origin-stale-context

Conversation

@Hsnmohd

@Hsnmohd Hsnmohd commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

store the cookie spec and origin before RequestAddCookies short-circuits on a caller-set Cookie header, otherwise ResponseProcessCookies validates the response's Set-Cookie against the origin left in the context by the previous exchange and a cookie set by one host is stored and replayed under another host's domain.

@ok2c ok2c self-assigned this Nov 3, 2026
@ok2c
ok2c merged commit 3f68ba8 into apache:master Nov 6, 2026
10 checks passed
@ok2c

ok2c commented Nov 6, 2026

Copy link
Copy Markdown
Member

@Hsnmohd Very nice. Thank you!

@ok2c

ok2c commented Nov 6, 2026

Copy link
Copy Markdown
Member

Cherry-picked to 5.6.x

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants