Home Search Pricing Get inErrata About

Sign in Sign up

Graph/33139195-78b6-4563-bbe0-6e4b3220ce93

Domainunvalidated

Public Suffix List

33139195-78b6-4563-bbe0-6e4b3220ce93

Public Suffix List

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

20 linked nodes

PERTAIN_TOProblem

Cookie “__vercel_live_token” has been rejected because it is in a cross-site context and its “SameSite” is “Lax” or “Strict” — deployed it on Vercel. Tension: But i setup cookies in my project like this. Outcome: Then you need to use https://localhost:5000 and not http://localhost:5000.

PERTAIN_TORootCause

My frontend domain was: `time-maste r-frontend.vercel.app` — My Backend domain was: `time-master-backend.vercel.app`. Tension: Is it because they both are of different domains? Outcome: they both are of different domains.

PERTAIN_TOProblem

when I refresh my page the cookie gets deleted — I have deployed my sveltekit frontend and python flask backend on vercel. Tension: On localhost, they worked just fine however when I deployed it, the cookies were not persistent. Outcome: it does sets the cookie, but on refresh, the cookie gets disappeared.

PERTAIN_TOSolution

two different domains cannot share cookies like that with each other — My frontend domain was: `time-master-frontend.vercel.app` My Backend domain was: `time-master-backend.vercel.app`. Tension: because they both are of different domains? Outcome: they need to be a subdomain or be one the same domain.

PERTAIN_TOSolution

make it work we might need to use subdomain for backend and main domain — using the http(80) and https(443) over the frontend. Tension: it's saying that it's already been used by some other website which is vercel. Outcome: i m gonna try with subdomain..

PERTAIN_TOProblem

The SvelteKit 2 (with Svelte 4) app runs correctly locally but fails during deployment on Vercel with a deployment/runtime error shown in the Vercel logs.

PERTAIN_TOSolution

Update @sveltejs/adapter-auto to the latest version compatible with SvelteKit 2 (and check for other outdated/incompatible packages) by running `npm outdated` and updating as needed.

PERTAIN_TOProblem

SessionMiddleware in a FastAPI backend fails to set the session cookie when the React frontend and backend are hosted on different domains/subdomains (e.g., XXX-ui.fly.dev vs XXX-api.fly.dev). The browser rejects the cookie with an 'invalid domain' error and no session is maintained.

PERTAIN_TOSolution

Use a single owned base domain and route UI and API via subdomains (e.g., my-app.com and api.my-app.com), then set the cookie Domain to a parent domain (e.g., `.my-app.com`) so the browser accepts it across subdomains (with SameSite=None and HTTPS).

PERTAIN_TOSolution

Use Curl_strntolower(lcase, domain, dlen+1) and Curl_strntolower(lcookie, co->domain, clen+1) — Patch lib/cookie.c around lines 1031-1048. Tension: This restores the intended PSL semantics regardless of the case attackers use in the Domain= attribute. Outcome: pass the normalized buffers to PSL.

PERTAIN_TOReport

CVE-2023-46218 — curl cookie mixed-case PSL bypass in Curl_cookie_add

PERTAIN_TOReport

CVE-2023-46218 curl cookie mixed-case PSL bypass in Curl_cookie_add

PERTAIN_TOReport

CVE-2023-46218: curl cookie domain matching logic bug allows cross-domain leakage

PERTAIN_TORootCause

acceptable = psl_is_cookie_domain_acceptable(psl, domain, co->domain);. Outcome: the PSL test never sees the canonical 'co.uk'.

PERTAIN_TOProblem

curl will accept and store the super-cookie — In lib/cookie.c, Curl_cookie_add() guards against setting cookies whose Domain attribute is a Public Suffix. Tension: libpsl's matching is case-sensitive against its lowercase PSL data. Outcome: the PSL test never sees the canonical 'co.uk'.

PERTAIN_TORootCause

file loading at line 1255 calls Curl_cookie_add(data, c, headerline, TRUE, lineptr, NULL, NULL, TRUE) — PSL check block at lines 1025-1048 guarded by USE_LIBPSL with guard condition requiring domain!=NULL. Tension: domain=NULL skips PSL.

PERTAIN_TORootCause

checks domain matching using cookie_tailmatch() without verifying that the cookie domain is not a public suffix — The Curl_cookie_getlist() function at lines 1408-1411 determines whether a cookie should be sent to a given host. Tension: Unlike Curl_cookie_add() which validates against PSL, the retrieval function has no such validation, creating an inconsistency.

IMPLEMENTATION_OFComponent

IMPLEMENTATION_OFPackage

IMPLEMENTATION_OFPackage

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Public Suffix List - inErrata Knowledge Graph | Inerrata