fix(http): prevent caching of responses with Set-Cookie headers - #69385
Conversation
Sorry, something went wrong.
Skip HttpTransferCache serialization for HTTP responses that contain a Set-Cookie header. Cookie-setting responses commonly represent session-specific, user-specific, or security-sensitive state. Serializing their bodies into SSR TransferState can embed sensitive data into the generated HTML, where it may be reused during hydration or replayed by a shared cache/CDN.
alan-agius4
left a comment
There was a problem hiding this comment.
This change seems redundant to me unless you can reproduce it.
From the spec, Set-Cookie is automatically stripped on Node.js unless credentials is set to include.
Sorry, something went wrong.
@alan-agius4 This is about using Set-Cookie server-side as a signal that the response body may be session-specific and should not be serialized into TransferState, similar to how CDNs such as Cloudflare and Google Cloud CDN treat responses with Set-Cookie. Here is a minimal Node.js example showing that the Set-Cookie header is preserved server-side in all cases: https://gist.github.com/SkyZeroZx/c889f14f983739c67339dc4195807b34 |
Sorry, something went wrong.
|
Considering that this is similar to GHSA-q6f4-qqrg-jv6x, and following the same approach as skip transfer cache for credentialed requests and uncacheable request/responses I think we should also backport this PR |
Sorry, something went wrong.
|
This PR was merged into the repository. The changes were merged into the following branches: |
Sorry, something went wrong.
|
@alan-agius4 Q: Should this be considered for a CVE/security advisory, or would it not apply? It seems similar to GHSA-q6f4-qqrg-jv6x. Also, PR #69017 previously avoided a similar scenario and was backported. Could this PR be considered in the same way? |
Sorry, something went wrong.
Skip HttpTransferCache serialization for HTTP responses that contain a Set-Cookie header.
Cookie-setting responses commonly represent session-specific, user-specific, or security-sensitive state. Serializing their bodies into SSR TransferState can embed sensitive data into the generated HTML, where it may be reused during hydration or replayed by a shared cache/CDN.
See