1579552 - Firefox is not complying with RFC6265 regarding processing the path attribute of cookies

Status: RESOLVED FIXED

(Core :: Networking: Cookies, defect)

Description

[Accountant]

User Agent: Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:66.0) Gecko/20100101 Firefox/66.0

Steps to reproduce:

I sent this header from my server "set-cookie: foo=1; path=/bar/"
then I requested /bar

Actual results:

Firefox sent the cookie to /bar

Expected results:

Firefox should not send this cookie to /bar .It only can send it to /bar/ or longer paths according to RFC 6265 path and path-match section

Chrome doesn't send it, here I posted a question on stackoverflow.com

https://stackoverflow.com/questions/57827565/firefox-is-not-complying-with-rfc6265-regarding-processing-the-path-attribute-of

Comment 1

[Dragana Damjanovic [:dragana]]

I think Chrome behavior is correct. Ehsan, can you take a look?

Comment 2

[(no longer active)]

Yes, our path matching algorithm is completely different than the spec. Comparing to Chrome's they seeming to be following the spec pretty closely.

Comment 3

[(no longer active)]

Attachment: Bug 1579552 - Update the cookie path matching algorithm per RFC6265;

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7449f505167b
Update the cookie path matching algorithm per RFC6265; r=baku

Comment 5

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/7449f505167b