opened
WildAndrewLee
username_0
Cookies are decrypted based on whether or not their value starts with `bkmk|`. It is possible to abuse this if a cookie is set by some malicious entity. In the event that a cookie starts with `bkmk|` but it's value is not able to be decrypted, Gatekeeper will error. We should add in some kind of error handling as well as logging to fix this.
Invalid Cookie Cause Errors
issue
created
WildAndrewLee
username_0
Added additional logging to failure to decrypt cookies. `get_cookie` should be modified to return `None` if a cookie does not exist. If a cookie does exist but cannot be decrypted then we should return `False`. In the event that `False` is returned then we should log the incident and then clear the invalid cookie.
comment
closed
WildAndrewLee
username_0
issue