fix(http): prevent caching of responses with Set-Cookie headers#69385
fix(http): prevent caching of responses with Set-Cookie headers#69385kirjs merged 1 commit intoangular:mainangular/angular:mainfrom SkyZeroZx:fix-http/here-we-go-againSkyZeroZx/angular:fix-http/here-we-go-againCopy head branch name to clipboard
Conversation
Skip HttpTransferCache serialization for HTTP responses that contain a Set-Cookie header. Cookie-setting responses commonly represent session-specific, user-specific, or security-sensitive state. Serializing their bodies into SSR TransferState can embed sensitive data into the generated HTML, where it may be reused during hydration or replayed by a shared cache/CDN.
alan-agius4
left a comment
There was a problem hiding this comment.
This change seems redundant to me unless you can reproduce it.
From the spec, Set-Cookie is automatically stripped on Node.js unless credentials is set to include.
@alan-agius4 This is about using Here is a minimal Node.js example showing that the https://gist.github.com/SkyZeroZx/c889f14f983739c67339dc4195807b34 |
|
Considering that this is similar to GHSA-q6f4-qqrg-jv6x, and following the same approach as skip transfer cache for credentialed requests and uncacheable request/responses I think we should also backport this PR |
Skip HttpTransferCache serialization for HTTP responses that contain a Set-Cookie header.
Cookie-setting responses commonly represent session-specific, user-specific, or security-sensitive state. Serializing their bodies into SSR TransferState can embed sensitive data into the generated HTML, where it may be reused during hydration or replayed by a shared cache/CDN.
See