Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle set-cookie for redirects #13

Closed
maccyber opened this issue Dec 1, 2022 · 0 comments
Closed

Handle set-cookie for redirects #13

maccyber opened this issue Dec 1, 2022 · 0 comments

Comments

@maccyber
Copy link
Contributor

maccyber commented Dec 1, 2022

Seems like we need to handle cookies that are set when the response is 301, 302, 303, 307, 308.

e.g. 302 responses can contain response.headers.set-cookie that we need to store.

To implement it fetch needs to handle redirects manually:

...
const response = await fetch(input, {
  ...interceptedInit,
  redirect: "manual",
});
...

... and check if it is a redirect status in response.status, then if it's a redirect; recursively call it self with something like.

...
    const redirectStatus = new Set([301, 302, 303, 307, 308]);
    if (!redirectStatus.has(response.status)) return response

    const redirectUrl = response.headers.get("location");
    if (!redirectUrl) return response;

    return await wrappedFetch(redirectUrl, init);
...

We also need to add a maxRedirect option to check against a counter to avoid redirect loops.

I don't have the time to finish this now, but started a draft that i think will work. Maybe someone will pick it up :-)

@jd1378 jd1378 closed this as completed in 4332a08 Dec 11, 2022
jd1378 added a commit that referenced this issue Dec 11, 2022
…onse

Handle set-cookie from a redirect response fixes #13
use `URL::hostname` instead of `URL::host` according to RFC ports don't matter
improve tests
prevent leaking sensitive headers to other domains after redirect
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant