Bug fix: thirdparty site cookie leak

[ranjit-git]

bug report https://www.huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31/

[ranjit-git]

Plz check this if Patch is working

[feross]

This only works for the first request because you're putting the flag and original_host variables in the module scope (at the top). Please fix.

Also, please run npm test to ensure you're matching the existing code style.

[ranjit-git]

I will fix the code style .

This only works for the first request because you're putting the flag and original_host variables in the module scope (at the top)

I have check this and it working for all request .
First let me clearify ,what i checking
http://mysite.com --->302--> http://redirect_1.com/ --> 302--> http://redirect_2.com/
Here i always checking mysite.com with redirect_1.com and mysite.com with redirect_2.com . if redirect host is different then dont send cookie .
So, when i set url like http://mysite.com/redirect.php?url=http://redirect_1.com/redirect.php?url=http://redirect_2.com then it does not send cookie to redirect_1.com,redirect_2.com .

[ranjit-git]

So, basically I checking with provided host with all redirect host and thats why i uses flag varriable .
There is another way
Check mysite.com with redirect_1.com and if again redirect found then check redirect_1.com with redirect_2.com and so on . And it does not required above flag varriable .
Plz let me know your idea

[ranjit-git]

i think you want the second way
like http://mysite.com -->302--> http://redirect_1.com -->302--> http://redirect_2.com
it should check mysite.com with redirect_1.com if again redirect found then check redirect_1.com with redirect_2.com and so on. right?
I will change PR to this method

[ranjit-git]

Hi, i just made a changes