Fix bogus sig problem add overwrite-flag #19
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 3 commits
November 13, 2012 11:18
This requires that the cookie header array is filtered when this flag is set. Since connect/express have custom handling for setHeader('Set-Cookie'), we need to bypass that to be able to fully control which cookies get written to the response. Hence the crazy prototype setup, to find a "working" setHeader without connect/express magic.
Caveat: Currently overwrites all cookies with the same name, regardless of path or domain. This is why I didn't make this global behaviour, so now the default is to behave as previously, but give the user the option to clear out any duplicates out of the request.
Reasoning for the whole commit: we can have a situation where one of our signed authentication cookies is corrupt (e.g. bad sig) but it's "parent" cookie is OK so we can regenerate the corrupt cookie by checking the parent cookie with a SSO-service. In this case, the cookies.get('child') tries to clear the 'child.sig'-cookie, with a 'Set-Cookie' with an empty value. Later, the SSO-check rewrites a correct 'child' cookie with it's sig. Without the overwrite flag, the .sig cookie gets duplicated into the 'Set-Cookie' header.
|
i'm a little leery of that magical-lookiing |
|
Hi, had a busy week. I figured out an easier and less brittle way to use the OutgoingMessage.setHeader, and hence bypass the connect-patch which is causing all the problems. See latest commit: e3b1247 As for the rest, the first two stand on their own, and... |
jed
added a commit
that referenced
this pull request
Nov 26, 2012
…rrides Fix bogus sig problem add overwrite-flag
|
thanks for your help, @mtkopone. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
cookie.get('cookie-with-bogus-sig') caused a cookie named 'cookie-with-bogus-sig.sig.sig' to get created.
overwrite-flag allows clearing out previous 'Set-Cookie'-declaration which set a cookie with the same name.
See individual commits for more info.