✨microservices✨ (But I did share your article internally and I’m hoping we can do something at our gateway tier 😅🤞) - ThreadSky

jacquesfavreau.com • 96 days ago

✨microservices✨

(But I did share your article internally and I’m hoping we can do something at our gateway tier 😅🤞)

Comments

I tried to open up a security bug with Netflix about a year back but ran into issues because it’s a security risk only so much as it would affect availability.

Personally this stuff would scare me at least a little, especially given the history of it actually happening.

And thanks for sharing!

jacquesfavreau.com•96 days ago

I’m also on team “If an engineer can make a sticky outage because they thought their debug “🫠” cookie value was funny, it’s more risk than I want on a random Thursday”

But my entire engineering schtick is “I’m not a great engineer so make it unsurprising and break loudly, early, and globally” so…

tice.me•96 days ago

Which, ironically, is what makes a great engineer

notwes.bsky.social•96 days ago

Not that I am going to get involved here, but.....the number of users complaining that the new major of the `cookie` package was more strict is not surprising at all. I would not be surprised to hear that "doing something" here would break something else.

notwes.bsky.social•96 days ago

I dont have time, but @april.social if you wanted to add the Node.js example to the article, here is the package to use: https://github.com/jshttp/cookie#readme

april.social•96 days ago

oooo do you have a quick test case that I could throw into a playground of some sort?

i’d be happy to add it if so.

notwes.bsky.social•96 days ago

That's what I didn't have time to produce sorry. I did just the bare minimum of

console.log(require('cookie').parse('unicodeCookie=🍪;'))

But I think the ideal would be to compare it with all of the different things you called out in the article. Might be we pass the unicode but break for others.

april.social•96 days ago

got it, no worries! i'll see if I can fit it in sometime this afternoon!

notwes.bsky.social•96 days ago

and I tested in both the new major and also the more popular `0.x` version which we ship in main line express and is the most downloaded package for cookie parsing in the JS ecosystem.

notwes.bsky.social•96 days ago

And just to check, I ran the unicode cookie through our parser and it seems to work correctly. Wouldn't be the first time Node.js had a more robust solution but was not included or generally dismissed.

Comments

Posting Rules

Reply