Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server contacted through the same CookieJar can plant a cookie for another domain, and the jar later sends that cookie to the victim domain, enabling session fixation or overwriting security-sensitive cookies. The patch validates the Set-Cookie domain against the response origin, although public-suffix rejection remains unimplemented. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

Affected: Maven: org.http4s:http4s-client_2.12, Maven: org.http4s:http4s-client_2.13, Maven: org.http4s:http4s-client_3

When processing a `Set-Cookie` from a response, the `CookieJar` client middleware trusts the server-supplied `Domain` attribute verbatim, with no check that it domain-matches the host that sent the cookie (RFC6265 §5.3 step 6) and no public suffix check. A malicious or compromised server can therefore plant a cookie for any domain in the cookie jar, which is subsequently set on the client's next request to that victim domain, enabling session fixation or overwriting security-relevant cookies.

## Impact

Session fixation and overwrite of security-relevant cookies for arbitrary domains contacted by the same wrapped client.

## Preconditions

- Application uses the `CookieJar` client middleware. - Application contacts an attacker-controlled (or compromised) server using the same jar it uses for trusted hosts.

## Workarounds

- Do not share a `CookieJar` across trusted and untrusted targets.

## Note

This middleware still does not implement public suffix rejection.