← Commit list

5e66176733

Daniel Stenberg

2026-05-28

SUCCESS Duration: 260s

Subject

http: don't pass on set cookies to new origins

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

lib/http.c +2 -1 tests/data/Makefile.am +1 -1 tests/data/test2015 +91 -0

lib/http.c+2 -1

@@ -2530,7 +2530,8 @@ static CURLcode http_cookies(struct Curl_easy *data,
	char *addcookies = NULL;
	bool linecap = FALSE;
	if(data->set.str[STRING_COOKIE] &&
-	!Curl_checkheaders(data, STRCONST("Cookie")))
+	!Curl_checkheaders(data, STRCONST("Cookie")) &&
+	Curl_auth_allowed_to_host(data))
	addcookies = data->set.str[STRING_COOKIE];

	if(data->cookies \|\| addcookies) {

tests/data/Makefile.am+1 -1

@@ -245,7 +245,7 @@ test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
	test1978 test1979 test1980 test1981 test1982 test1983 test1984 \
	\
	test2000 test2001 test2002 test2003 test2004 test2005 test2006 test2007 \
-	test2008 test2009 test2010 test2011 test2012 test2013 test2014 \
+	test2008 test2009 test2010 test2011 test2012 test2013 test2014 test2015 \
	\
	test2023 \
	test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \

tests/data/test2015+91 -0

@@ -0,0 +1,91 @@
+	<?xml version="1.0" encoding="US-ASCII"?>
+	<testcase>
+	<info>
+	<keywords>
+	HTTP
+	HTTP proxy
+	followlocation
+	cookies
+	</keywords>
+	</info>
+	# Server-side
+	<reply>
+	<data>
+	HTTP/1.1 302 OK
+	Date: Tue, 09 Nov 2010 14:49:00 GMT
+	Server: test-server/fake swsclose
+	Content-Type: text/html
+	Funny-head: yesyes
+	Location: http://goto.second.host.now/%TESTNUMBER0002
+	Content-Length: 8
+	Connection: close
+
+	contents
+	</data>
+	<data2>
+	HTTP/1.1 200 OK
+	Date: Tue, 09 Nov 2010 14:49:00 GMT
+	Server: test-server/fake swsclose
+	Content-Type: text/html
+	Funny-head: yesyes
+	Content-Length: 9
+
+	contents
+	</data2>
+
+	<datacheck>
+	HTTP/1.1 302 OK
+	Date: Tue, 09 Nov 2010 14:49:00 GMT
+	Server: test-server/fake swsclose
+	Content-Type: text/html
+	Funny-head: yesyes
+	Location: http://goto.second.host.now/%TESTNUMBER0002
+	Content-Length: 8
+	Connection: close
+
+	HTTP/1.1 200 OK
+	Date: Tue, 09 Nov 2010 14:49:00 GMT
+	Server: test-server/fake swsclose
+	Content-Type: text/html
+	Funny-head: yesyes
+	Content-Length: 9
+
+	contents
+	</datacheck>
+	</reply>
+
+	# Client-side
+	<client>
+	<server>
+	http
+	</server>
+	<name>
+	HTTP with cookie with with -b and redirect to new host
+	</name>
+	<command>
+	http://first.host.it.is/we/want/that/page/%TESTNUMBER -x %HOSTIP:%HTTPPORT -b "test=yes" --location
+	</command>
+	<features>
+	proxy
+	</features>
+	</client>
+
+	# Verify data after the test has been "shot"
+	<verify>
+	<protocol crlf="headers">
+	GET http://first.host.it.is/we/want/that/page/%TESTNUMBER HTTP/1.1
+	Host: first.host.it.is
+	User-Agent: curl/%VERSION
+	Accept: /
+	Proxy-Connection: Keep-Alive
+	Cookie: test=yes
+
+	GET http://goto.second.host.now/%TESTNUMBER0002 HTTP/1.1
+	Host: goto.second.host.now
+	User-Agent: curl/%VERSION
+	Accept: /
+	Proxy-Connection: Keep-Alive
+
+	</protocol>
+	</verify>
+	</testcase>