No match on .google.com cookie domain against www.google.com

[rubengmurray]

Hi,

Is this behaviour expected?

bertrandom/chrome-cookies-secure#66 (comment)

• Cookie domain is .google.com (extracted from cookie)
• Domain passed in is www.google.com
• A match is not made

This used to work back in [email protected]

tough-cookie/lib/cookie.js

Line 301 in e4dfb0a

function domainMatch(str, domStr, canonicalize) {

Quote from issue in chrome-cookies-secure

---

^Fails inside domainMatch.ts for https://www.google.com

https://github.com/salesforce/tough-cookie/blob/master/lib/cookie/domainMatch.ts#L95

For https://google.com this always passes

https://github.com/salesforce/tough-cookie/blob/master/lib/cookie/domainMatch.ts#L88

[colincasey]

@rubengmurray I'm going to rephrase your question just to make sure I'm understanding you (please correct me if I've misunderstood):

The domainMatch function in [email protected] used to return true when called with domainMatch("www.google.com", ".google.com") but now in [email protected] it returns false. Is this expected?

If so, I think you're correct that this is a regression bug. The comparison against performed here should be against the canonicalized _domStr, not the non-canonicalized cookieDomain.

[rubengmurray]

@rubengmurray I'm going to rephrase your question just to make sure I'm understanding you (please correct me if I've misunderstood):

The domainMatch function in [email protected] used to return true when called with domainMatch("www.google.com", ".google.com") but now in [email protected] it returns false. Is this expected?

If so, I think you're correct that this is a regression bug. The comparison against performed here should be against the canonicalized _domStr, not the non-canonicalized cookieDomain.

That's a clearer way of putting it yes. Thanks for checking this out.

[colincasey]

@rubengmurray this fix should now be available in https://www.npmjs.com/package/tough-cookie/v/5.1.2

[rubengmurray]

Perfect. Latest version works in chrome-cookies-secure tests 👍