[go: up one dir, main page]

Tech Eval: Set path variable at cookie level to avoid leaking restricted and private projects/subgroups pages under the same top level group

Problem

While fixing the GitLab Pages without DNS wildcard - MVC (gitlab#17584 - closed), we are reintroducing the issue that was fixed by Unique pages site domain (&9347 - closed)

For more information: https://gitlab.com/gitlab-org/gitlab/-/issues/363329+

Proposed Solution

Evaluate if we can utilise path variable at cookie level, to avoid leaking restricted and private projects/subgroups pages under the same top level group.

Cookie path documentation: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value

/cc @mmacfarlane @johnhope