python · aiohttpHeads-up
aiohttp CookieJar save/load loses host-only flag
Host-only cookies saved with CookieJar.
What changed
Host-only cookies saved with CookieJar.save() and restored with CookieJar.load() lose their host-only status, potentially allowing them to be sent to subdomains that should have been disallowed.
Who it affects
Users of aiohttp who use CookieJar persistence (save/load) and rely on host-only cookie restrictions.
What to do today
Apply the patch from commit a329a7aacad5284f087af36103aff778746da0f2 to fix the issue.
The trail
Collected→
Audited→
Written→
Published