Uploaded image for project: 'Couchbase Lite'
  1. Couchbase Lite
  2. CBL-394

Platform WebSocket code should manage HTTP cookies - Android

    XMLWordPrintable

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.7.0
    • Fix Version/s: 2.8.0
    • Component/s: Java-Android
    • Security Level: Public
    • Labels:
      None
    • Sprint:
      Pasin 27
    • Story Points:
      5

      Description

      LiteCore's Replicator class has been managing HTTP cookies so far. Before creating the C4Socket it looks up cookies and adds them to the HTTP header options, and when the C4Socket returns the HTTP response the Replicator class handles the Set-Cookie header.

      I'm taking this out because it isn't correct when the request gets redirected:

      • The cookies will be sent on every redirected request, even to hosts they're not intended for, which could potentially leak sensitive data.
      • Any Set-Cookie responses from intermediate responses will be ignored because those responses don't get sent back to the replicator.

      Instead, cookies need to be applied and stored on a hop-by-hop basis, i.e. each HTTP request and response. This is the job of the platform C4Socket implementation. It should:

      • Call c4db_getCookies() before sending each HTTP request and add the cookies.
      • If a response contains Set-Cookie header(s), call c4db_setCookie().

      This LiteCore change is currently on the development branch (feature/xsockets). I'm not sure when this branch will be merged; likely for Mercury.

        Attachments

          Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

            Activity

            Hide
            build-team Couchbase Build Team added a comment -

            Build couchbase-lite-android-2.8.0-258 contains couchbase-lite-java-ce commit 8df3b8d with commit message:
            CBL-394: Add CookieStore provider to SocketFactory (#3)

            Show
            build-team Couchbase Build Team added a comment - Build couchbase-lite-android-2.8.0-258 contains couchbase-lite-java-ce commit 8df3b8d with commit message: CBL-394 : Add CookieStore provider to SocketFactory (#3)
            Hide
            build-team Couchbase Build Team added a comment -

            Build couchbase-lite-android-2.8.0-258 contains couchbase-lite-java-common commit 7c413cd with commit message:
            CBL-394: Manage cookies from platform code (#10)

            Show
            build-team Couchbase Build Team added a comment - Build couchbase-lite-android-2.8.0-258 contains couchbase-lite-java-common commit 7c413cd with commit message: CBL-394 : Manage cookies from platform code (#10)
            Hide
            build-team Couchbase Build Team added a comment -

            Build couchbase-lite-android-2.8.0-258 contains couchbase-lite-java-ee-root commit 9fef4f3 with commit message:
            CBL-394: Add CookieStores provider to SocketFactory and implement ReplicatorCookieTest (#12)

            Show
            build-team Couchbase Build Team added a comment - Build couchbase-lite-android-2.8.0-258 contains couchbase-lite-java-ee-root commit 9fef4f3 with commit message: CBL-394 : Add CookieStores provider to SocketFactory and implement ReplicatorCookieTest (#12)
            Hide
            build-team Couchbase Build Team added a comment -

            Build couchbase-lite-java-2.8.0-240 contains couchbase-lite-java-ce commit 8df3b8d with commit message:
            CBL-394: Add CookieStore provider to SocketFactory (#3)

            Show
            build-team Couchbase Build Team added a comment - Build couchbase-lite-java-2.8.0-240 contains couchbase-lite-java-ce commit 8df3b8d with commit message: CBL-394 : Add CookieStore provider to SocketFactory (#3)
            Hide
            build-team Couchbase Build Team added a comment -

            Build couchbase-lite-java-2.8.0-240 contains couchbase-lite-java-common commit 7c413cd with commit message:
            CBL-394: Manage cookies from platform code (#10)

            Show
            build-team Couchbase Build Team added a comment - Build couchbase-lite-java-2.8.0-240 contains couchbase-lite-java-common commit 7c413cd with commit message: CBL-394 : Manage cookies from platform code (#10)
            Hide
            build-team Couchbase Build Team added a comment -

            Build couchbase-lite-java-2.8.0-240 contains couchbase-lite-java-ee-root commit 9fef4f3 with commit message:
            CBL-394: Add CookieStores provider to SocketFactory and implement ReplicatorCookieTest (#12)

            Show
            build-team Couchbase Build Team added a comment - Build couchbase-lite-java-2.8.0-240 contains couchbase-lite-java-ee-root commit 9fef4f3 with commit message: CBL-394 : Add CookieStores provider to SocketFactory and implement ReplicatorCookieTest (#12)

              People

              Assignee:
              pasin Pasin Suriyentrakorn
              Reporter:
              pasin Pasin Suriyentrakorn
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Gerrit Reviews

                  There are no open Gerrit changes

                    PagerDuty