Cookie poisoning cxone fix (#3991)

SAP · Oct 15, 2024 · dabd9f5 · dabd9f5
1 parent cfbea09
commit dabd9f5
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 11 deletions.
diff --git a/client/src/lifecycleManager.js b/client/src/lifecycleManager.js
@@ -146,28 +146,26 @@ class LifecycleManager extends LuigiClientBase {
     let tpc = 'enabled';
     let cookies = document.cookie;
     let luigiCookie;
-    let luigiCookieKey;
     if (cookies) {
       luigiCookie = cookies
         .split(';')
         .map(cookie => cookie.trim())
-        .find(cookie => cookie == 'luigiCookie=true');
+        .find(cookie => cookie === 'luigiCookie=true');
     }
     if (luigiCookie === 'luigiCookie=true') {
-      luigiCookieKey = luigiCookie.split('=')[0];
-      document.cookie = luigiCookieKey + '=; Max-Age=-99999999; SameSite=None; Secure';
+      document.cookie = 'luigiCookie=; Max-Age=-99999999; SameSite=None; Secure';
     }
     document.cookie = 'luigiCookie=true; SameSite=None; Secure';
     cookies = document.cookie;
     if (cookies) {
       luigiCookie = cookies
         .split(';')
         .map(cookie => cookie.trim())
-        .find(cookie => cookie == 'luigiCookie=true');
+        .find(cookie => cookie === 'luigiCookie=true');
     }
     if (luigiCookie === 'luigiCookie=true') {
+      document.cookie = 'luigiCookie=; Max-Age=-99999999; SameSite=None; Secure';
       window.parent.postMessage({ msg: 'luigi.third-party-cookie', tpc }, '*');
-      document.cookie = luigiCookieKey + '=; Max-Age=-99999999; SameSite=None; Secure';
     } else {
       tpc = 'disabled';
       window.parent.postMessage({ msg: 'luigi.third-party-cookie', tpc }, '*');

diff --git a/container/cypress/e2e/test-app/iframe/iframe-container.cy.js b/container/cypress/e2e/test-app/iframe/iframe-container.cy.js
@@ -16,7 +16,7 @@ describe('Iframe Container Test', () => {
       .get('iframe')
       .then(() => {
         cy.wrap(stub).should('have.been.calledWith', 'set-third-party-cookies-request');
-        cy.getCookie('luigiCookie').should('exist');
+        cy.getCookie('luigiCookie').should('not.exist');
       });
   });
 

diff --git a/core/third-party-cookies/init.html b/core/third-party-cookies/init.html
@@ -2,16 +2,14 @@
   <script>
     let cookies = document.cookie;
     let luigiCookie;
-    let luigiCookieKey;
     if (cookies) {
       luigiCookie = cookies
         .split(';')
         .map(cookie => cookie.trim())
         .find(cookie => cookie == 'luigiCookie=true');
     }
     if (luigiCookie === 'luigiCookie=true') {
-      luigiCookieKey = luigiCookie.split('=')[0];
-      document.cookie = luigiCookieKey + '=; Max-Age=-99999999; SameSite=None; Secure';
+      document.cookie = 'luigiCookie=; Max-Age=-99999999; SameSite=None; Secure';
     }
     document.cookie = 'luigiCookie=true; SameSite=None; Secure';
     cookies = document.cookie;
@@ -23,7 +21,7 @@
     }
     if (luigiCookie === 'luigiCookie=true') {
       window.parent.postMessage('luigi.tpcEnabled', '*');
-      document.cookie = luigiCookieKey + '=; Max-Age=-99999999; SameSite=None; Secure';
+      document.cookie = 'luigiCookie=; Max-Age=-99999999; SameSite=None; Secure';
     } else {
       window.parent.postMessage('luigi.tpcDisabled', '*');
       console.warn('Third party cookies are not supported!');