mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Remove cookies from Clear-Site-Data Header 

In 2f87fb6b45 this header was introduced. The referenced documentation says:

> When delivered with a response from https://example.com/clear, the following header will cause cookies associated with the origin https://example.com to be cleared, as well as cookies on any origin in the same registered domain (e.g. https://www.example.com/ and https://more.subdomains.example.com/).

This also applies if `https://nextcloud.example.com/` sends the `Clear-Site-Data: "cookies"` header.
This is not the behavior we want at this point!

So I removed the deletion of cookies from the header. This has no effect on the logout process as this header is supported only recently and the logout works in old browsers as well.

Signed-off-by: Patrick Conrad <conrad@iza.org>
(cherry picked from commit 1806baaeaf)
This commit is contained in:
Patrick Conrad 2018-10-15 14:25:08 +02:00
parent ae17e55f42
commit 06e43bb46a
No known key found for this signature in database
GPG Key ID: A4FD5EDF3D1B8663
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/Controller/LoginController.php
View File

@ -120,7 +120,7 @@ class LoginController extends Controller {
$this->userSession->logout();
$response = new RedirectResponse($this->urlGenerator->linkToRouteAbsolute('core.login.showLoginForm'));
$response->addHeader('Clear-Site-Data', '"cache", "cookies", "storage", "executionContexts"');
$response->addHeader('Clear-Site-Data', '"cache", "storage", "executionContexts"');
return $response;
}

4
tests/Core/Controller/LoginControllerTest.php
View File

@ -100,7 +100,7 @@ class LoginControllerTest extends TestCase {
->willReturn('/login');
$expected = new RedirectResponse('/login');
$expected->addHeader('Clear-Site-Data', '"cache", "cookies", "storage", "executionContexts"');
$expected->addHeader('Clear-Site-Data', '"cache", "storage", "executionContexts"');
$this->assertEquals($expected, $this->loginController->logout());
}
@ -130,7 +130,7 @@ class LoginControllerTest extends TestCase {
->willReturn('/login');
$expected = new RedirectResponse('/login');
$expected->addHeader('Clear-Site-Data', '"cache", "cookies", "storage", "executionContexts"');
$expected->addHeader('Clear-Site-Data', '"cache", "storage", "executionContexts"');
$this->assertEquals($expected, $this->loginController->logout());
}