feat(http): add cookie config options to control unencrypted cookie discarding#2132
Open
rexpl wants to merge 3 commits into
Open
feat(http): add cookie config options to control unencrypted cookie discarding#2132rexpl wants to merge 3 commits into
rexpl wants to merge 3 commits into
Conversation
innocenzi
requested changes
May 21, 2026
Member
innocenzi
left a comment
innocenzi
left a comment
There was a problem hiding this comment.
Looks good, just a few minor changes
|
|
||
| final class CookieConfig | ||
| { | ||
| public function __construct( |
Member
There was a problem hiding this comment.
Can you add docblocks to describe the functionality of each option?
|
|
||
| final class CookieHandlingTest extends FrameworkIntegrationTestCase | ||
| { | ||
| public function test_encrypted_cookies_are_kept_when_default(): void |
Member
There was a problem hiding this comment.
Would appreciate using #[Test] for new tests instead of the method name prefix 🙏
| public function test_encrypted_cookies_are_kept_when_default(): void | ||
| { | ||
| try { | ||
| /** @var \Tempest\Cryptography\Encryption\Encrypter $encrypter */ |
Member
There was a problem hiding this comment.
I don't think this is needed, Container has @template
Benchmark ResultsComparison of Open to see the benchmark results
Generated by phpbench against commit 40ecf51 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I was surprised by the default Tempest behaviour of discarding any cookie it did not encrypt itself. Cookies from other legitimate services (ex: reverse proxy) would silently get discarded. Two new
CookieConfigoptions allow developers to handle this:discardUnencryptedCookiesto disable discarding entirely, andplaintextCookiesto allowlist specific cookies by name.Original behaviour is preserved, but can now be opted out (fully or partially).