question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Cookie header not cleared upon cross-domain redirect

See original GitHub issue

Hey there!

I belong to an open source security research community, and a member (@ranjit-git) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Reactions:5
  • Comments:7

github_iconTop GitHub Comments

5reactions
RubenVerborghcommented, Jan 10, 2022

Fixed, thanks again for responsible disclosure.

1reaction
ranjit-gitcommented, Jan 7, 2022

Thanks @RubenVerborgh happy to secure opensource project. Can you plz Mark the report as valid ?

Read more comments on GitHub >

github_iconTop Results From Across the Web

Cross-Domain Cookie not sent to application after redirect
When I directly afterwards investigate on the cookies (Google Chrome), I can see that the cookie was set with the correct domain and...
Read more >
696204 - Cookies are ignored on 302 redirects - Monorail
My Set-Cookie header in response 2 looks like this: ... Without a repro, it's not even clear if what's occurring is expected or...
Read more >
Set-Cookie - HTTP - MDN Web Docs
Controls whether or not a cookie is sent with cross-site requests, providing some protection against cross-site request forgery attacks (CSRF).
Read more >
Secure cross-domain cookies for HTTP
To set cross-domain cookies our server uses the new Xdc-Set-Cookie header. Normally, the client would discard those cookies for which the server ...
Read more >
Chapter 5. Cookies and response headers - CORS in Action
By default, CORS doesn't attach user credentials, such as cookies, on requests. ... This can get confusing, and it may not be clear...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found