Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cookie domain attribute should optionally be disabled #10

Closed
jwwheeleriv opened this issue Sep 15, 2021 · 1 comment · Fixed by #11
Closed

Cookie domain attribute should optionally be disabled #10

jwwheeleriv opened this issue Sep 15, 2021 · 1 comment · Fixed by #11
Labels
feature-request New feature or request
Milestone
1.1.0

Comments

@jwwheeleriv
Copy link
Contributor

What would you like to be added:

Cognito-At-Edge by default sets all cookies with the domain attribute. This attribute really should be optional as it leads to issues where you may not want to share cookies across subdomains and could potentially lead to WAF restrictions if a WAF restricts the size of cookie headers.

Why is this needed:

The Domain attribute specifies which hosts are allowed to receive the cookie. If unspecified, it defaults to the same host that set the cookie, excluding subdomains. If Domain is specified, then subdomains are always included. Therefore, specifying Domain is less restrictive than omitting it. However, it can be helpful when subdomains need to share information about a user.
jwwheeleriv added a commit to jwwheeleriv/cognito-at-edge that referenced this issue Sep 15, 2021
@jwwheeleriv
added optional disableCookieDomain parameter (awslabs#10)
364866b 
    * add disable cookie domain attribute as optional
     - in case app needs to exclude domain attribute
       which is more restrictive (ie. not allow subdomains)
     - defaults to false to maintain backwards compatibility
        (ie. include domain if false or not specified).

    * add (Optional) to the disableCookieDomain param documentation
@jwwheeleriv jwwheeleriv changed the title Cookie domain attribute should be optional Cookie domain attribute should optionally be disabled Sep 16, 2021
jeandek pushed a commit that referenced this issue Oct 4, 2021
@jwwheeleriv
added optional disableCookieDomain parameter (#10) (#11)
0bd6bc5 
* add disable cookie domain attribute as optional
     - in case app needs to exclude domain attribute
       which is more restrictive (ie. not allow subdomains)
     - defaults to false to maintain backwards compatibility
        (ie. include domain if false or not specified).

    * add (Optional) to the disableCookieDomain param documentation
@jeandek
Copy link
Contributor

jeandek commented Oct 4, 2021

Thanks for the PR Jay. I'll publish the new version of the package to NPM by the end of the week.

@jeandek jeandek closed this as completed Oct 4, 2021
@jeandek jeandek added this to the 1.1.0 milestone Oct 4, 2021
@jeandek jeandek added the feature-request New feature or request label Oct 4, 2021
@jeandek jeandek linked a pull request Jan 7, 2022 that will close this issue
added optional disableCookieDomain parameter #11
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
feature-request New feature or request
Projects
None yet
Milestone
1.1.0
Development

Successfully merging a pull request may close this issue.

added optional disableCookieDomain parameter jwwheeleriv/cognito-at-edge
2 participants
@jeandek @jwwheeleriv