Commit dcf4e3a8 authored by Alan-Shields's avatar Alan-Shields
Browse files

rfc2109: allow nil to be passed to safe-parse-cookies

The docs say that you can pass nil to safe-parse-cookies to have no
legal domains to allow cookies to come from (ie they must come from your
server or not at all).
Whoops.

darcs-hash:a18e1d6748baa7fcc2a2a23d8c7f8b2f31e7bc88
parent f450fdd7
Loading
Loading
Loading
Loading
+1 −1
Original line number Diff line number Diff line
@@ -1443,7 +1443,7 @@ to be allowed by the specification"
; 

(defun safe-parse-cookies (cookie-string &optional (domain-restriction ""))
  (declare (type (or string cons) domain-restriction)
  (declare (type (or null string cons) domain-restriction)
	   (type string cookie-string))
  "Parse a cookie string (see parse-cookies), but only allow domain cookies that match domain-restriction
RFC 2109 specifies that, in order to avoid a cookie spoofing attack,