0 Releases 5 Tags

RSS Feed

• 2026.09.05.05 f7c9a28c33

  Compare

  a login through the proxy lost its csrf cookie, and looped

  pastilhas released this 2026-09-05 20:23:48 +00:00

  stripHopByHop copies headers with out.set(key, value), which overwrites.
  Correct for every header except the one that legitimately repeats: a NextAuth
  sign-in sends several Set-Cookie - csrf-token, callback-url, session-token - and
  collapsing them to one drops the rest.

  Measured: two Set-Cookie headers direct from Linkwarden, one through the door,
  and the survivor was callback-url. So the csrf cookie never reached the browser,
  the sign-in posted, failed its CSRF check and bounced back to the form. A
  redirect loop with nothing in any log saying why - and the owner predicted this
  exact symptom from the other side before it was found.

  getSetCookie() returns them unjoined, which is the reason to use it rather than
  splitting a combined value: Expires contains a comma, so naive splitting
  corrupts the date and the cookie is discarded.

  Both hops use this one function, so both are fixed by it.

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)