Golang Minimal CookieJar Implementation which always returns all cookies, regardless of domain or url (Insecure but usefull for testing or writing POCs)

minimalcj.go

package main

/*
Minimal CookieJar implementation which always returns all cookies (ie. disregard the url passed and cookie domain)
Usefull for testing or writing exploit code (eg. during a CTF where ip/host/domains may be interchanged in the client)

WARNING: Do not use in prod.. this is super unsafe... Just good for testing

Author: fyx.me
gist: https://gist.github.com/fyxme/2bceed4038e2be71ce1deb7e6e9db434
*/

import (
	"net/http"
	"slices"
	"maps"
	"net/url"
)

/*
// https://pkg.go.dev/net/http/cookiejar#Jar.Cookies
// https://pkg.go.dev/net/http#CookieJar
type CookieJar interface {
	// SetCookies handles the receipt of the cookies in a reply for the
	// given URL.  It may or may not choose to save the cookies, depending
	// on the jar's policy and implementation.
	SetCookies(u *url.URL, cookies []*Cookie)

	// Cookies returns the cookies to send in a request for the given URL.
	// It is up to the implementation to honor the standard cookie use
	// restrictions such as in RFC 6265.
	Cookies(u *url.URL) []*Cookie
}
*/
type MinimalJar struct {
	// map the cookie name to the cookie itself
	cookies map[string]*http.Cookie
}


func (j *MinimalJar) SetCookies(u *url.URL, cookies []*http.Cookie) {
	for _, c := range cookies {
		// cookies should have a name
		if c.Name == "" {
			continue
		}
		// ignore the domain
		c.Domain = ""
		// ignore the path
		c.Path = ""
		j.cookies[c.Name] = c
	}
}

func (j *MinimalJar) Cookies(u *url.URL) []*http.Cookie {
	// we dont care about the url, we just always return all cookies
	return slices.Collect(maps.Values(j.cookies))
}


func NewJar() (*MinimalJar) {
	jar := &MinimalJar{
		cookies: make(map[string]*http.Cookie),
	}
	return jar
}

func (j *MinimalJar) AddCookie(name, value string) {
	cookie := &http.Cookie{
                Name:   name,
                Value:  value,
        }
	j.cookies[name]=cookie
}

Example Usage:

package main

import (
	"fmt"
	"io/ioutil"
	"net/http"
	"net/url"
	"strings"
)


func main() {
	jar := NewJar()

	jar.AddCookie("test", "asdf")

	var cookies []*http.Cookie
	cookie := &http.Cookie{
		Name:   "M_WEIBOCN_PARAMS",
		Value:  "rl%3D1",
	}
	cookies = append(cookies, cookie)
	cookie = &http.Cookie{
		Name:   "SUB",
		Value:  "xxx",
		Path:   "/",
		Domain: ".weibo.cn",
	}
	cookies = append(cookies, cookie)

	jar.SetCookies(nil, cookies)

        // Cookies: [test=asdf M_WEIBOCN_PARAMS=rl%3D1 SUB=xxx]
	fmt.Println("Cookies:", jar.Cookies(nil))

	client := &http.Client{
		Jar: jar,
	}

	postData := url.Values{}
	postData.Set("asdf", "asdf")
	postData.Set("test", "test")
	req, _ := http.NewRequest("POST", "https://asdf.requestcatcher.com/", strings.NewReader(postData.Encode()))
	req.Header.Add("Content-Type", "application/json")
	resp, err := client.Do(req)
	if err != nil {
		panic(nil)
	}
	body, _ := ioutil.ReadAll(resp.Body)
	resp.Body.Close()
	fmt.Println(string(body))
}

Request:

POST / HTTP/1.1
Host: asdf.requestcatcher.com
Accept-Encoding: gzip
Content-Length: 19
Content-Type: application/json
Cookie: test=asdf; M_WEIBOCN_PARAMS=rl%3D1; SUB=xxx
User-Agent: Go-http-client/1.1

asdf=asdf&test=test