qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-21 21:34:40 -07:00
Code Releases Activity

net/http: do not send leading dot in cookie domain attribute

Browse Source 
RFC 6265 allows a leading dot in a cookie domain attribute
but is clear (see section 4.1.1) that a Set-Cookie header
should be sent without these dots.

R=bradfitz
CC=golang-dev
https://golang.org/cl/13111043
This commit is contained in:
Volker Dobler 2013-08-26 07:41:37 -05:00 committed by Brad Fitzpatrick
parent 61f3fdcaec
commit f1d61b959f
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/pkg/net/http/cookie.go
View File

@ -149,8 +149,13 @@ func (c *Cookie) String() string {
if validCookieDomain(c.Domain) {
// A c.Domain containing illegal characters is not
// sanitized but simply dropped which turns the cookie
// into a host-only cookie.
fmt.Fprintf(&b, "; Domain=%s", c.Domain)
// into a host-only cookie. A leading dot is okay
// but won't be sent.
d := c.Domain
if d[0] == '.' {
d = d[1:]
}
fmt.Fprintf(&b, "; Domain=%s", d)
} else {
log.Printf("net/http: invalid Cookie.Domain %q; dropping domain attribute",
c.Domain)

2
src/pkg/net/http/cookie_test.go
View File

@ -26,7 +26,7 @@ var writeSetCookiesTests = []struct {
},
{
&Cookie{Name: "cookie-3", Value: "three", Domain: ".example.com"},
"cookie-3=three; Domain=.example.com",
"cookie-3=three; Domain=example.com",
},
{
&Cookie{Name: "cookie-4", Value: "four", Path: "/restricted/"},