fix(http): prevent caching of responses with Set-Cookie headers#69385
fix(http): prevent caching of responses with Set-Cookie headers#69385SkyZeroZx wants to merge 1 commit into
Conversation
Skip HttpTransferCache serialization for HTTP responses that contain a Set-Cookie header. Cookie-setting responses commonly represent session-specific, user-specific, or security-sensitive state. Serializing their bodies into SSR TransferState can embed sensitive data into the generated HTML, where it may be reused during hydration or replayed by a shared cache/CDN.
alan-agius4
left a comment
There was a problem hiding this comment.
This change seems redundant to me unless you can reproduce it.
From the spec, Set-Cookie is automatically stripped on Node.js unless credentials is set to include.
@alan-agius4 This is about using Here is a minimal Node.js example showing that the https://gist.github.com/SkyZeroZx/c889f14f983739c67339dc4195807b34 |
Skip HttpTransferCache serialization for HTTP responses that contain a Set-Cookie header.
Cookie-setting responses commonly represent session-specific, user-specific, or security-sensitive state. Serializing their bodies into SSR TransferState can embed sensitive data into the generated HTML, where it may be reused during hydration or replayed by a shared cache/CDN.
See