Conflicting cookies shenanigans with `SESSION_COOKIE_DOMAIN` about flask

[azmeuk]

I can think of the Configuration Handling > SESSION_COOKIE_DOMAIN section, or in the Security > Set-Cookie Options section indeed.

I would expect to read this more on the configuration I think. As you want.

[davidism]

I am confident that we are currently doing the right thing with cookie domain. I spent a long time looking through the relevant current specs and browser behavior when reviewing that code last year.

Given the current way browsers handle cookies, it is less secure to set the domain property than to leave it unset. You're seeing the result of the two different behaviors here. When you set a domain, the cookie is valid for that and all subdomains. When you don't set a domain, the browser makes it valid only for the domain that requested it. When both cookies are set, the browser has to pick one to send first.

[davidism]

You can attempt to issue an few extra response.delete_cookie calls for each setting on some response, but beyond that we can't really affect what the browser stores and sends if you start sending it different overlapping things at different times.

[azmeuk]

When both cookies are set, the browser has to pick one to send first.

Does Flask has to pick the first one sent by the browser, or would it make sense for Flask to use the cookie with the most suitable domain, if that information is ever available?

You can attempt to issue an few extra response.delete_cookie calls for each setting on some response

response.delete_cookie("session", "flask.localhost") works, but response.delete_cookie("session", ".flask.localhost") does not, whatever the value of SESSION_COOKIE_DOMAIN.

[davidism]

The domain information is not present in the Cookie request header, it is only key=value.

A leading dot is irrelevant in modern browsers, it's equivalent to the same domain without the dot. So both those calls are the same. The other call would be delete_cookie without the domain at all.

[azmeuk]

I see, thank you for your insight.
In the end I could solve the situation simply by abandoning both cookies by changing the SESSION_COOKIE_NAME.

I think this would be worth mentioning in the documentation though. Would you be OK if I write a little caveat paragraph about this?

[davidism]

Sure, but where? It might be mentioned in the Werkzeug API docs already. Maybe in the security section for the Flask docs?