Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Handling cookies is a minefield

grayduck.mn

Post reply on HN
Print view View original

1–10 of 270 posts

Re: Handling cookies is a minefield

#3

Post by jerf »

And the article isn't even about the proliferation of attributes cookies have, that browsers honor, and in some cases are just mandatory. I was trying to explain SameSite to a coworker, and scrolled down a bit... https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#co... wait, cookie prefixes? What the heck are those? The draft appears to date to 2016, but I've been trying to write secure cookie code for longer than that, hadn't heard of it until recently, and I can't really find when they went in to browsers (because there's a lot more drafts than there are implemented drafts and the date doesn't mean much necessarily), replies explaining that welcome.

Seems like every time I look at cookies they've grown a new wrinkle. They're just a nightmare to keep up with.

Re: Handling cookies is a minefield

#4

Post by paol »

Cookie header parsing is a shitshow. The "standards" don't represent what actually exists in the wild, each back-end server and/or library and/or framework accepts something different, and browsers do something else yet.

If you are in complete control of front-end and back-end it's not a big problem, but as soon as you have to get different stuff to interoperate it gets very stupid very fast.

Re: Handling cookies is a minefield

#5

Post by hinkley » 

    Firefox accepts five characters which RFC recommends that servers not send:

    0x09 (horizontal tab)
    0x20 (spaces)
    0x22 (double quotes)
    0x2C (commas)
    0x5C (backslashes)
I agree with at least some of these. Cookies without commas? Quotes?

Re: Handling cookies is a minefield

#6

Post by kibwen »

The article mentions Rust's approach, but note that (unlike the other mentioned languages) Rust doesn't ship any cookie handling facilities in the standard library, so it's actually looking at the behavior of the third-party "cookie" crate (which includes the option to percent-encode as Ruby does): https://docs.rs/cookie/0.18.1/cookie/

Re: Handling cookies is a minefield

#7

Post by juped »

kibwen wrote: post #6

The article mentions Rust's approach, but note that (unlike the other mentioned languages) Rust doesn't ship any cookie handling facilities in the standard library, so it's actually looking at the behavior of the third-party "cookie" crate (which includes the option to percent-encode as Ruby does): https://docs.rs/cookie/0.18.1/cookie/

De facto standardization by snapping up good names early!

Re: Handling cookies is a minefield

#8

Post by remram »

hinkley wrote: post #5

Firefox accepts five characters which RFC recommends that servers not send: 0x09 (horizontal tab) 0x20 (spaces) 0x22 (double quotes) 0x2C (commas) 0x5C (backslashes) I agree with at least some of these. Cookies without commas? Quotes?

Quotes in the value when quotes delimit the value? Yeah that seems dangerous to me.

Re: Handling cookies is a minefield

#9

Post by minitech »

jerf wrote: post #3

And the article isn't even about the proliferation of attributes cookies have, that browsers honor, and in some cases are just mandatory. I was trying to explain SameSite to a coworker, and scrolled down a bit... https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#co... wait, cookie prefixes ? What the heck are those? The draft appears to date to 2016, but I've been trying to write secure cookie code for longer…

> https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#co... wait, cookie prefixes? What the heck are those?

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#co...

> For more information about cookie prefixes and the current state of browser support, see the Prefixes section of the Set-Cookie reference article.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...

(Cookie prefixes have been widely supported since 2016 and more or less globally supported since 2019.)

They’re backwards-compatible, so if your cookie need meets the requirements for the `__Host-` prefix, you should use `__Host-`.

Re: Handling cookies is a minefield

#10

Post by marumari »

kibwen wrote: post #6

The article mentions Rust's approach, but note that (unlike the other mentioned languages) Rust doesn't ship any cookie handling facilities in the standard library, so it's actually looking at the behavior of the third-party "cookie" crate (which includes the option to percent-encode as Ruby does): https://docs.rs/cookie/0.18.1/cookie/

Thanks for pointing that out -- I've updated the article and given you credit down at the bottom. Let me know if you'd prefer something other than "kibwen."
Post reply on HN