Enable optional strict domain checking for cookies.

Review Request #14223 — Created Nov. 2, 2024 and submitted

Information

RBTools
release-5.x

Reviewers

Python's cookie handler defaults to including cookies from any parent
domain in a request to a subdomain. This can lead to issues if the same
cookie is present for both domains, as the wrong cookie may end up
winning. This isn't standard cookie behavior in all clients, but it is
in Python, and it's not configurable.

This is a problem in the case where you have a primary server (e.g.,
rb.example.com) and a staging server as a subdomain (e.g.,
staging.rb.example.com).

To address this, we have a new option, COOKIES_STRICT_DOMAIN_MATCH.
When set, this overrides Python's default cookie logic to require an
exact domain match unless the cookie's domain contains a leading .
(which indicates a cookie intended to be used for subdomains).

This is off by default, in case this could impact any deployments out
there, but it can be safely enabled in most cases.

Unit tests pass.

Successfully posted changes to a subdomain exhibiting this problem
once the option was turned on.

Summary ID
Enable optional strict domain checking for cookies.
Python's cookie handler defaults to including cookies from any parent domain in a request to a subdomain. This can lead to issues if the same cookie is present for both domains, as the wrong cookie may end up winning. This isn't standard cookie behavior in all clients, but it is in Python, and it's not configurable. This is a problem in the case where you have a primary server (e.g., `rb.example.com`) and a staging server as a subdomain (e.g., `staging.rb.example.com`). To address this, we have a new option, `COOKIES_STRICT_DOMAIN_MATCH`. When set, this overrides Python's default cookie logic to require an exact domain match unless the cookie's domain contains a leading `.` (which indicates a cookie intended to be used for subdomains). This is off by default, in case this could impact any deployments out there, but it can be safely enabled in most cases.
e9d3831759b06c3eb3e27d4893c76a37e94bd028
Description From Last Updated

You're missing the COOKIES_STRICT_DOMAIN_MATCH section header.

daviddavid

Missing the "Version Added" here.

maubinmaubin
maubin
  1. 
      
  2. rbtools/api/request.py (Diff revision 1)
     
     
     
    Show all issues

    Missing the "Version Added" here.

  3. 
      
david
  1. 
      
  2. docs/rbtools/rbt/configuration/users.rst (Diff revision 1)
     
     
     
     
     
    Show all issues

    You're missing the COOKIES_STRICT_DOMAIN_MATCH section header.

  3. 
      
chipx86
david
  1. Ship It!
  2. 
      
chipx86
Review request changed
Status:
Completed
Change Summary:
Pushed to release-5.x (c264936)