non-secure cookie conflict with secure cookie(with same name,different domain)
Reported by
yhong...@sohu.com,
Feb 15 2017
|
||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Steps to reproduce the problem: 1. page A(in work.mysite.com) set a secure cookie(name:"JSESSIONID",domain:"work.mysite.com",path:"/") 2. page B(in b.mysite.com) set a non-secure cookie(name:"JSESSIONID",domain:".mysite.com",path:"/") What is the expected behavior? browser save both cookies from page A and page B. It works well in firefox. What went wrong? cookie from page B missed Did this work before? N/A Chrome version: 56.0.2924.87 Channel: stable OS Version: 6.1 (Windows 7, Windows Server 2008 R2) Flash Version:
,
Feb 15 2017
,
Feb 17 2017
Reporter@ - Thanks for filing the issue...!! Could you please provide a sample URL to test this issue. This will help us in triaging the issue further. Thanks...!!
,
Feb 17 2017
Hi! Thanks for the report. This is an intentional change we made to protect `secure` cookies: https://tools.ietf.org/html/draft-ietf-httpbis-cookie-alone-01. This will break in Firefox 52, as well, FWIW: https://developer.mozilla.org/en-US/Firefox/Releases/52#HTTP. |
||||
►
Sign in to add a comment |
||||
Comment 1 by och...@chromium.org
, Feb 15 2017Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug