Opened 63 minutes ago
Last modified 48 minutes ago
#37342 assigned New feature
set_cookie() should reject __Host- / __Secure- prefixes browsers will silently drop
| Reported by: | GhostCoder6969 | Owned by: | GhostCoder6969 |
|---|---|---|---|
| Component: | HTTP handling | Version: | 6.1 |
| Severity: | Normal | Keywords: | |
| Cc: | GhostCoder6969 | Triage Stage: | Unreviewed |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
Browsers silently ignore a Set-Cookie response when the name uses the Host- prefix without Secure + Path=/ and no Domain attribute, or the Secure- prefix without Secure. Django currently accepts such cookies without complaint, so a misconfigured SESSION_COOKIE_NAME / CSRF_COOKIE_NAME (or any set_cookie call) fails open with no signal.
Proposed: raise ValueError from HttpResponse.set_cookie() when the name carries a Host- / Secure- prefix whose requirements the cookie attributes don't satisfy.
Reference implementation: GH PR django/django#21955 (will link this ticket there once filed).
Change History (2)
comment:1 by , 53 minutes ago
| Has patch: | set |
|---|
comment:2 by , 48 minutes ago
| Owner: | set to |
|---|---|
| Status: | new → assigned |
Note:
See TracTickets
for help on using tickets.