Cookie header not cleared upon cross-domain redirect
See original GitHub issueHey there!
I belong to an open source security research community, and a member (@ranjit-git) has found an issue, but doesn’t know the best way to disclose it.
If not a hassle, might you kindly add a SECURITY.md
file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.
Thank you for your consideration, and I look forward to hearing from you!
(cc @huntr-helper)
Issue Analytics
- State:
- Created 2 years ago
- Reactions:5
- Comments:7
Top Results From Across the Web
Cross-Domain Cookie not sent to application after redirect
When I directly afterwards investigate on the cookies (Google Chrome), I can see that the cookie was set with the correct domain and...
Read more >696204 - Cookies are ignored on 302 redirects - Monorail
My Set-Cookie header in response 2 looks like this: ... Without a repro, it's not even clear if what's occurring is expected or...
Read more >Set-Cookie - HTTP - MDN Web Docs
Controls whether or not a cookie is sent with cross-site requests, providing some protection against cross-site request forgery attacks (CSRF).
Read more >Secure cross-domain cookies for HTTP
To set cross-domain cookies our server uses the new Xdc-Set-Cookie header. Normally, the client would discard those cookies for which the server ...
Read more >Chapter 5. Cookies and response headers - CORS in Action
By default, CORS doesn't attach user credentials, such as cookies, on requests. ... This can get confusing, and it may not be clear...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Fixed, thanks again for responsible disclosure.
Thanks @RubenVerborgh happy to secure opensource project. Can you plz Mark the report as valid ?