Skip to content

Add project prefix in session cookie path

Naman Jagdish Gala requested to merge ngala/1088-session-cookie-path into master

What does this MR do?

Add project prefix in session cookie path

Setting path variable at cookie level avoids leaking restricted and private projects/subgroups pages under the same top level group.
I have kept this under feature flag: FF_ENABLE_PROJECT_PREFIX_COOKIE_PATH
Related issue: Tech Eval: Set path variable at cookie level to... (#1088 - closed)

Cookie path documentation: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value

Changelog: added

Recording:

Before this fix After this fix
Before Session Cookie Path.mov After Session Cookie Path.mov

TODO

Edited by Naman Jagdish Gala

Merge request reports

Loading