Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update IdentifiableCookie.java #61

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Conversation

Eluch
Copy link

@Eluch Eluch commented May 17, 2019

Skip secure flag check on equals and hashCode generation.

My problem was that a server sent a set-cookie with "secure" and "HttpOnly" flags, then later after logout it sent a similar set-cookie without those flags.

The "SetCookieCache" java class then had it duplicated in the cookies Set (it should have replace the old one).

I wrote a PHP script to test how chrome handling this (i used https for the tests to be sure):

<?php
$iter = $_GET['iter'] ?? 1;

if ($iter == 1) { 
    setcookie('cookie_test_s_h', 'test', time() + 3600, '/', '', true, true);
    setcookie('cookie_test_s', 'test', time() + 3600, '/', '', true, false);
    setcookie('cookie_test_h', 'test', time() + 3600, '/', '', false, true);
    header('Location: ?iter=2');
} else if ($iter == 2) {
    // exit; 
    setcookie('cookie_test_s_h', 'empty', time() + 3600, '/', '', false, false);
    setcookie('cookie_test_s', 'empty', time() + 3600, '/', '', false, false);
    setcookie('cookie_test_h', 'empty', time() + 3600, '/', '', false, false);
    header('Location: ?iter=3');
} else { 
    echo 'Done';
}

After the first iteration:
image

After the second iteration I got the result what I expected:
image

TL;DR

This commit fixes the duplicate cookie problem what happens when the following situation happens:

set-cookie: as=SOME_TOKEN_HERE; expires=Fri, 17-May-2019 16:17:01 GMT; path=/; secure; HttpOnly
set-cookie: as=; expires=Thu, 16-May-2019 16:12:02 GMT; path=/

Skip secure flag check on equals and hashCode generation
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant