forwardemail / forwardemail/superagent
[fix] Agent cookies are not correctly attached to right domains/paths on redirect
- Dominant language
- JavaScript
- Stars
- 16.6k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Description
## Describe the bug
**Node.js version:** 20.11.0
**OS version:** MacOS Sonoma 14.5
**Description:**
We are using superagent agent to perform an OpenID authorization code flow before interface tests, crossing domain boundaries on multiple redirects. After upgrading from superagent 8.0.8 to 9.0.2, this fails because of missing cookies in the latter redirects.
After adding some console.logs to the agent lib, it looks like in 8.0.8 the `_saveCookies()` method is not storing the right url.hostname/path but `null`/`null`, which means that all cookies are attached later irrespective of the domain, while in 9.0.2 it's passing wrong domains and paths into `this.jar.setCookies()`, so that they are not attached later.
## Actual behavior
Example:
agent starts in domain `www.service.org` which sets a `session` Cookie, then redirects to `oidc.service.org` for authentication, which itself sets cookies.
Afterwards the same agent is used to post login credentials on `oidc.service.org`, which causes a redirect back to `www.service.org`. Now the `session` cookie is not passed to `www.service.org`, as it has been saved in the cookie jar with the redirection host/path for `oidc.service.org`.
## Expected behavior
Cookies set in the response of any redirecting request that have no domain part by themselves should be saved with the domain of that exact request, not with that of the followup request.
## Checklist
- [X] I have searched through GitHub issues for similar issues.
- [X] I have completely read through the README and documentation.
- [X] I have tested my code with the latest version of Node.js and this package and confirmed it is still not working.
Contributor guide
Assessment
This issue has not been assessed yet.