[bug] Override behaviour of double cookies parameter in modules.json

[Inareous]

Prerequisite

• [x] I'm using the latest version.
• [x] All website modules are up to date.
• [x] This is not temporary server issue.

System information Win 10 1809

Describe the bug In modules.json exist 2 kinds of cookies parameter for each ID, the "Cookies" array (a cookiejar) and "HTTP.Cookies" string. The array is produced automatically by FMD2 while HTTP.Cookies string is a user configured cookie string. When both exist, the cookiejar override HTTP.Cookies, not the other way around. In this case, when __cfuid and cf_clearance of the site is not validated (case in point: Kissmanga's AreYouHuman2 server side cookies verification) user cannot override the __cfuid and cf_clearance using their own cookies since the one used will always be the "Cookies" array.

To Reproduce

Steps to reproduce the behavior:

-

Expected behavior HTTP.Cookies from user configuration will override "Cookies" array produced by FMD2

Screenshots

Additional context

-

[dazedcat19]

should it merge into an existing cookies from cookiejar(replace the only matched key) or completely replace them. the problem is when override none main domain. since it will merge per website module, regardless of it's domain. so if a website module trying to load different domain it will also merge/replace them. the more comprehensive solution is maybe to add domain field for each key. or maybe user should enter server cookies defined in rfc6265. Set-cookie: domain=... https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie. But maybe that will be too complicated from user perspective.

[Inareous]

I think https://github.com/dazedcat19/FMD2/commit/f51565c59275263c4842b1fbb9136eb69f5b1d35 merging existing cookie should be good, no need to completely replace them.

Regarding replacing regardless of domain, yes i think this could be a problem for a matching key for different domain, cf implementation on 2 different domain would be a good example since it will override both. Setting an optional domain value for the user config could be a way i think. While the default behaviour is to merge/replace all, user could specify the domain if they want to, this gives flexibility for user to set cookies with domain specific if they want to for specific module, but still can do simple ones (that don't care for specific domain) for another module.

[dazedcat19]

closed for now.