Open j0k3r opened 2 years ago
Didn't check in depth but we may need to add a test to ensure that we don't leak cookies if the next page is not on the same domain. What do you think?
That's a good question, this shouldn't happen so much. Should we add the cookie in the cookie jar instead so it'll be checked later in the foreach?
I've checked and cookies we are re-injecting are only those which are defined in site config, so there shouldn't really contains sensitive data? Otherwise I don't know how to fix the leak because at the point where we should check it, we don't know the host associated to cookies which are in the headers.
It was the case for golem.de, the cookie wasn't properly send to the next page (might be a bug in the cookie jar not properly retrieving previous defined cookies).
Fix https://github.com/j0k3r/graby-site-config/issues/48