Repair Cookie Scope Leakage

The problem

Cookie storage and matching logic in custom SDKs or proxies often grant broader authority than the Set-Cookie contract allows. This leads to security leaks where host-only cookies are sent to subdomains or secure cookies leak over unencrypted channels.

What it does

• Identifies failures in host-only, Domain, and Path matching logic within the repository.
• Patches Set-Cookie parsing to enforce canonical storage identity and public-suffix boundaries.
• Fixes deletion logic where different scopes prevent session cleanup.
• Corrects request attachment paths to prevent cookies from leaking to sibling tenants or parent domains.
• Implements redacted observability and deterministic local fixtures for regression testing.

Why this beats prompting it yourself

Manual prompts often overlook the nuance between host-only and Domain-level cookies, leading to incomplete fixes that break session persistence. This skill enforces a strict canonical contract for normalization and validation, ensuring repairs align with browser-compatible security standards without leaking secrets in logs.

Use cases

• Preventing session cookies from leaking to sibling subdomains in multi-tenant apps.
• Fixing broken cookie deletion logic caused by scope mismatches.
• Enforcing Secure and SameSite attributes in custom proxy or client implementations.
• Standardizing Path matching to prevent string prefix overlaps from leaking data.

Known limitations

Does not contact production services or read live secrets. Repository-level IDNA and public-suffix support depend on existing local libraries.