On 2/17/2016 5:19 PM, Pierre Brico wrote:
Hello,
I've a question about the usage of libcurl with Secure Flag on Cookie.
I'm writing a injector tool to perform benchmark on web application.
This tool is based on libcurl and libevent.
The web application isn't exposed directly to the web but uses a F5
ASM for security purposes. This F5 appliance takes the HTTPS flow,
process it from a security point of view and then forward it as HTTP
to the web server.
USER <=> INTERNET <=> F5 <=> APPLICATION
HTTPS HTTPS HTTP
For my injection tool, I would like to avoid using the F5 and connect
directly to the application server. But the application is sending
Cookie with Secure flag enabled (which is working with the F5 but not
using direct connection HTTP).
So my question is: is it possible to tell libcurl to ignore the Secure
Flag and process the Cookie as a "normal" cookie ?
I don't see that supported and I think it's unlikely it will be. You can
override the behavior of the cookie parser quick and dirty to include
secure cookies in a particular host's cookie list even if the connection
is not secured, but you'll have to edit the source to do it. The cookies
when read/written from the cookie file will still have their original
secure flag.
https://github.com/curl/curl/blob/curl-7_47_1/lib/cookie.c#L1049-L1053
example:
diff --git a/lib/cookie.c b/lib/cookie.c
index c542476..e90ce82 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -1059,7 +1059,8 @@ struct Cookie *Curl_cookie_getlist(struct
CookieInfo *c,
date AND that if the cookie requires we're secure we must only
continue if we are! */
if((!co->expires || (co->expires > now)) &&
- (co->secure?secure:TRUE)) {
+ (Curl_raw_equal(host, "the-host-to-ignore-secure-flag") ||
+ (co->secure?secure:TRUE))) {
/* now check if the domain is correct */
if(!co->domain ||
-------------------------------------------------------------------
List admin: https://cool.haxx.se/list/listinfo/curl-library
Etiquette: https://curl.haxx.se/mail/etiquette.html
