[Edbrowse-dev] xhr cookies

[Edbrowse-dev] xhr cookies

[Karl Dahlke]

Well Kevin pointed out to me something I hadn't thought about at all.
His template code includes a piece to update document.cookie,
in the current window, as per the cookies that come in through an xhr request.
So let's follow it through.

xhr does an http fetch.
Cookies come back from the website.
Cookies are updated in cookie space and in the jar by curl.
All good.
We return from the http request and javascript sees the http headers.
It uses those to adjust document.cookie, the string of current cookies,
which doesn't yet have the new cookies in it.
Again all good, as long as the xhr url is the same as the current url.
Otherwise you're adding foreign cookies to document.cookie,
that don't belong there.

I thought about replicating all the logic in cookies.c to see if the cookies
really belong - compare the xhr url with window.location.lhref.
That kind of wheel reinvention really irks at me.
Instead I thought we could do this,
and Kevin let me know if you want to try it or have me do it.

In the native code, after http returns successfully,
write a variation of docCookie() in ebjs.c.
This calls curl and asks for the latest batch of cookies,
but you want to use window.location.href as your url.
You'll get a string of cookies back, current and correct for this url,
without the http-only cookies and using all the logic
we already wrote,
and then you just use
set_property_string1(document.cookie, cookieList);
But caution, remember to suspend the setters.
We don't want to feed these cookies back into the jar,
they're already there.

suspend_setter = true;
set_property_string1(document.cookie, cookieList);
suspend_setter = false;

Anyways I think that's the easy way to keep cookies consistent
across xhr.

Karl Dahlke

Re: [Edbrowse-dev] xhr cookies

[Kevin Carhart]

I'm glad I raised something salient.

> Instead I thought we could do this,
> and Kevin let me know if you want to try it or have me do it.

If you have time, please go ahead- it will be a better outcome
than if I am implementing your thinking on how to do it.

thanks
Kevin