Skip to content

Commit

Permalink
Strip cookies for "/chat"
Browse files Browse the repository at this point in the history
We currently strip cookies which lack a relevant session cookie for any
URLs starting "/chat/" (note the trailing slash).

We want to extend the same functionality to the "/chat" URL as well.

It's pretty important that we match _only_ "/chat" (and not, for
example, "/chat-with-someone").
  • Loading branch information
jackbot committed Nov 19, 2024
1 parent 18fbbae commit 45cbce4
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions www/www.vcl.tftpl
Original file line number Diff line number Diff line change
Expand Up @@ -230,7 +230,7 @@ sub vcl_recv {
if (req.method !~ "^(GET|HEAD|POST|PUT|DELETE|OPTIONS|PATCH|FASTLYPURGE)") {
error 806 "Not Implemented";
}

%{ if private_extra_vcl_recv != "" ~}
${private_extra_vcl_recv}
%{ endif ~}
Expand Down Expand Up @@ -380,9 +380,9 @@ sub vcl_recv {
}
%{ endif ~}

# Strip cookies for requests to /chat/* that lack a session cookie,
# Strip cookies for requests to /chat or /chat/* that lack a session cookie,
# otherwise pass through
if (req.url ~ "^/chat/") {
if (req.url.path ~ "^/chat(/.*)?$") {
if (req.http.cookie:_govuk_chat_session) {
return(pass);
# These endpoints make use of HEAD requests and we don't want these
Expand Down

0 comments on commit 45cbce4

Please sign in to comment.