Files
insomnia/packages/insomnia-scripting-environment
Kyle 3080674643 sec: preserve cookie source tag through the scripting bridge
The pre-request/after-response script bridge (insomnia-scripting-environment's
CookieObject/CookieJar) round-tripped cookies without their 'manual'/'response'
source tag on every script run, even ones that never touch cookies.
savePatchesMadeByScript then defaulted any untagged cookie to 'manual' (trusted),
letting a server-planted (Set-Cookie) cookie's value be rendered as a live
template on the next request -- reopening the hole closed by #10475.

Thread 'source' through the bridge so it survives the round-trip, and make
savePatchesMadeByScript's fallback fail closed: an untagged cookie is only
trusted as 'manual' if it's genuinely new (no matching id in the jar as it
stood before the script ran).
2026-09-18 18:22:18 -04:00
..