Fix cookie scoping for HTTPS urls.

twisted / treq

Python requests like API built on top of Twisted's HTTP client.

Other

587 stars 140 forks source link

Fix cookie scoping for HTTPS urls. #343

Closed dreid closed 2 years ago

dreid commented 2 years ago

If Cookie.port is specified not None then CookieJar will attempt to compare it to the port for the Request object by first parsing it out of Request.host and if there is no port specified there falling back to the DEFAULT_HTTP_PORT value of 80.

This caused cookies to never be sent for HTTPS domains because the Cookie.port was set to 443, and the _FakeUrllib2Request.host did not contain the default port value.

I've also added a test to make sure non-default port values work properly.

glyph commented 2 years ago

@twm if you have a minute to do another fast-following release once this lands that would be great, this is a pretty bad bug in our security fix :-|