Problem/Motivation

Hi there. I currently use Drupal core's and Symfony's session cookies (via #1361742: Fix cookie conflicts on shared domains) and would like to start using this module instead, but the way that cookie prefixes are handled in this module means that we wouldn't be able to use the __Host cookie prefix because this module would prefix it with S in HTTPS, resulting in S__Host, which basically defeats the reason I'd want to customize the cookie prefix.

More information on cookie prefixes:

Steps to reproduce

Set cookie prefix to __Host; log in via HTTPS; inspect cookies in dev tools; notice the cookie name starts with S__Host.

Proposed resolution

Instead of prefixing the configured prefix, add a suffix to the prefix for HTTPS, in between the configured prefix and the randomly generated part. Alternatively, given that HTTPS should arguably be the default for the web at this point in time, instead add the collision avoidance to any insecure (non-HTTPS) cookies and leave HTTPS cookie names alone.

Remaining tasks

See above.

User interface changes

Mostly just update form description.

API changes

None I think?

Data model changes

Unsure but probably none.

Issue fork persistent_login-3360187

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

Ambient.Impact created an issue. See original summary.

gapple made their first commit to this issue’s fork.

gapple opened merge request !8

gapple’s picture

gapple
he/they
Primary language English
commented
Status: Active » Needs review

Let me know if this MR works for you - it should preserve the prefix on the prefix, resulting in cookie names like __Host-PL669af8b697a5f362dffd3f58410ac59e and __Host-SPL669af8b697a5f362dffd3f58410ac59e

ambient.impact’s picture

ambient.impact
they/them
Primary language English
Location Toronto
commented

Awesome work! Will check out once I have some time to spare.

ambient.impact’s picture

ambient.impact
they/them
Primary language English
Location Toronto
commented

I had a chance to try this out on a bare bones Drupal 10 site and I can confirm it works! Noticed a couple of unrelated issues so I'll open follow ups.

  • gapple committed 7b03ed8d on 2.x 
    Issue #3360187: Support Secure and Host cookie prefixes
gapple’s picture

gapple
he/they
Primary language English
commented
Status: Needs review » Fixed

gapple closed merge request !8

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.