dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibHTTP: Preserve single-dot cookie domains

Browse source 
I suspect this is not an important case, but since both Firefox and
Chromium implement it, let's match their behaviour. While this does
not matter the exact letter of the spec, the relevant WPT test was
alongside this spec text as part of a spec change trying to align
to align spec behaviour with Chromium and Firefox, so I believe
what is implemented here to be the intention of the specification
authors.
This commit is contained in:
Shannon Booth 2026-06-10 22:39:10 +02:00 committed by Shannon Booth
parent 5a000da13e
commit 928007356c
2 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
Libraries/LibHTTP/Cookie/ParsedCookie.cpp
View file

@ -268,7 +268,11 @@ ErrorOr<void> on_domain_attribute(ParsedCookie& parsed_cookie, StringView attrib
auto cookie_domain = attribute_value;
// 2. If cookie-domain starts with %x2E ("."), let cookie-domain be cookie-domain without its leading %x2E (".").
if (cookie_domain.starts_with('.'))
// NB: We deliberately keep a lone "." rather than reducing it to "". By the letter of the spec this would
// become an empty domain and be stored as a host cookie, but Chromium, Firefox, WPT (and the spec intent)
// treat an treat `Domain=.` as an invalid domain.
// See: https://github.com/httpwg/http-extensions/issues/1939
if (cookie_domain.length() > 1 && cookie_domain.starts_with('.'))
cookie_domain = cookie_domain.substring_view(1);
// 3. Convert the cookie-domain to lower case.

6
Tests/LibWeb/Text/expected/wpt-import/cookies/attributes/domain.sub.txt
View file

@ -2,8 +2,8 @@ Harness status: OK
Found 55 tests
53 Pass
2 Fail
54 Pass
1 Fail
Pass Test cookie domain attribute parsing
Pass Return cookie for a domain match
Pass No cookie returned for domain mismatch (subdomains differ post-redirect)
@ -51,7 +51,7 @@ Pass Cookie returned for bare domain attribute following mismatched domain attri
Pass No cookie returned for domain mismatch (first attribute is a different subdomain and second is bare)
Pass Cookies with same name, path, and domain (differing only in leading '.') overwrite each other ('.' second)
Pass Cookies with same name, path, and domain (differing only in leading '.') overwrite each other ('.' first)
Fail No cookie returned for domain with single dot ('.') value.
Pass No cookie returned for domain with single dot ('.') value.
Pass Return cookie with valid domain after domain with single dot ('.') value.
Pass Empty domain treated as host cookie 1
Pass Empty domain treated as host cookie 2