mirror of
https://github.com/Kong/insomnia.git
synced 2026-11-05 12:33:40 -05:00
The pre-request/after-response script bridge (insomnia-scripting-environment's CookieObject/CookieJar) round-tripped cookies without their 'manual'/'response' source tag on every script run, even ones that never touch cookies. savePatchesMadeByScript then defaulted any untagged cookie to 'manual' (trusted), letting a server-planted (Set-Cookie) cookie's value be rendered as a live template on the next request -- reopening the hole closed by #10475. Thread 'source' through the bridge so it survives the round-trip, and make savePatchesMadeByScript's fallback fail closed: an untagged cookie is only trusted as 'manual' if it's genuinely new (no matching id in the jar as it stood before the script ran).