Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incompatible with Symfony's clearCookie() strategy #313

Open
johnpez opened this issue Jul 29, 2022 · 1 comment · May be fixed by #315
Open

Incompatible with Symfony's clearCookie() strategy #313

johnpez opened this issue Jul 29, 2022 · 1 comment · May be fixed by #315

Comments

@johnpez
Copy link

johnpez commented Jul 29, 2022

Symfony's default method of deleting cookies is calling $response->headers->clearCookie('cookie_name') which sets the cookie to have a value of null and an expiration in 1 second.

This breaks if the cookie is signed, on line 79 of SignedCookieListener.php, when the code attempts to sign the "null" value.

$this->signer->getSignedValue($cookie->getValue()) fails when $cookie->getValue() returns null.

I'm not entirely sure what the cleanest solution is. Either changing the above line to not try to sign them if the value is null (probably?). Or, maybe converting null values to a string?

For now, my workaround is to avoid clearCookie and to set the cookie to an expiration of 1 and a value of '', but this is messier than using the built-in Symfony method.

@Seldaek
Copy link
Member

Seldaek commented Aug 12, 2022

I think skipping the signing if we detect a null value sounds good, if you want to send a PR

@GwendolenLynch GwendolenLynch linked a pull request Sep 3, 2022 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants