Skip to content

nitcorn: Non POLA cookie behavior cause lost sessions #2278

Open
@privat

Description

@privat

nitcorn cookies are assigned by path. This cause some issues when tracking sessions

In the following example, the 3 GET cause the creation of 3 distinct sessions

Then, the next GET that revisits foo is given a different session (the one of / is used, but it seems there is some randomness)

example: https://gist.github.com/privat/e769dad16423cfcd3c921d603496107e

This cause sessions to be lost and external authentification with a redirect (like github oauth) to fail

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions