Issues

• Security Advisory: Uncontrolled recursion in CookieJar deserialization throws an uncatchable RangeError that crashes the process

  salesforce/tough-cookie#641 · Filter by author waydeshi opened on Sep 22, 2026

• setCookie rejects an IPv4-literal Domain attribute as a "public suffix"

  salesforce/tough-cookie#626 · Filter by author maximilliangrand opened on Aug 14, 2026

• Introduce CookieDateString nominal type

  6265bis
  salesforce/tough-cookie#590 · Filter by author colincasey opened on Mar 13, 2026

• Introduce RequestHost nominal type

  6265bis
  salesforce/tough-cookie#589 · Filter by author colincasey opened on Mar 13, 2026

• Introduce CookieExpiryDate nominal type

  6265bis
  salesforce/tough-cookie#588 · Filter by author colincasey opened on Mar 13, 2026

• Introduce PrefixSecurityMode string literal union type

  6265bis
  salesforce/tough-cookie#587 · Filter by author colincasey opened on Mar 13, 2026

• Introduce CookieValue nominal type

  6265bis
  salesforce/tough-cookie#586 · Filter by author colincasey opened on Mar 13, 2026

• Introduce CookieName nominal type

  6265bis
  salesforce/tough-cookie#585 · Filter by author colincasey opened on Mar 13, 2026

• Introduce MaxAgeSeconds nominal type

  6265bis
  salesforce/tough-cookie#584 · Filter by author colincasey opened on Mar 13, 2026

• Introduce SameSiteLevel string literal union type

  6265bis
  salesforce/tough-cookie#583 · Filter by author colincasey opened on Mar 13, 2026

• Introduce CookiePath nominal type

  6265bis
  salesforce/tough-cookie#582 · Filter by author colincasey opened on Mar 13, 2026

• Improve internal type safety with nominal types

  6265bis
  salesforce/tough-cookie#581 · Filter by author colincasey opened on Mar 13, 2026

• Refactor domainMatch signature to use CanonicalDomain branded type

  6265bis
  salesforce/tough-cookie#579 · Filter by author colincasey opened on Mar 13, 2026

• Implement draft bis-22 validation in canonicalizedHostName

  salesforce/tough-cookie#568 · Filter by author colincasey opened on Mar 12, 2026

• Move IPv6 handling from canonicalDomain to a separate utility

  salesforce/tough-cookie#567 · Filter by author colincasey opened on Mar 12, 2026

• Move leading-dot stripping from canonicalDomain to domain attribute processing

  salesforce/tough-cookie#566 · Filter by author colincasey opened on Mar 12, 2026

• Add configuration to control RFC 6265 vs bis-22 behavior

  salesforce/tough-cookie#565 · Filter by author colincasey opened on Mar 12, 2026

• Deprecate canonicalDomain in favor of canonicalizedHostName

  salesforce/tough-cookie#564 · Filter by author colincasey opened on Mar 12, 2026

• Review Draft 20 - 5. User Agent Requirements

  6265bis
  Task

  salesforce/tough-cookie#518 · Filter by author colincasey opened on Apr 14, 2025

• Review Draft 20 - 5.1.4. Paths and Path-Match

  6265bis
  Task

  salesforce/tough-cookie#517 · Filter by author colincasey opened on Apr 14, 2025

• Review Draft 20 - 5.1. Subcomponent Algorithms

  6265bis
  Task

  salesforce/tough-cookie#516 · Filter by author colincasey opened on Apr 14, 2025

• Review Draft 20 - 5.2.1. Document-based requests

  6265bis
  Task

  salesforce/tough-cookie#515 · Filter by author colincasey opened on Apr 14, 2025

• Review Draft 20 - 5.2. "Same-site" and "cross-site" Requests

  6265bis
  Task

  salesforce/tough-cookie#514 · Filter by author colincasey opened on Apr 14, 2025

• Review Draft 20 - 5.1.2. Canonicalized Host Names

  6265bis
  Task

  salesforce/tough-cookie#512 · Filter by author colincasey opened on Apr 14, 2025

• Add CONTRIBUTING.md and ARCHITECTURE.md

  salesforce/tough-cookie#496 · Filter by author wjhsf opened on Feb 7, 2025