Chop of ports for session cookies. This fixes pallets#253

mitsuhiko · mitsuhiko · commit ccd5ced70e48 · 2011-06-27T09:40:45.000+02:00
diff --git a/flask/app.py b/flask/app.py
@@ -602,7 +602,8 @@ def save_session(self, session, response):
         if session.permanent:
             expires = datetime.utcnow() + self.permanent_session_lifetime
         if self.config['SERVER_NAME'] is not None:
-            domain = '.' + self.config['SERVER_NAME']
+            # chop of the port which is usually not supported by browsers
+            domain = '.' + self.config['SERVER_NAME'].rsplit(':', 1)[0]
         session.save_cookie(response, self.session_cookie_name,
                             expires=expires, httponly=True, domain=domain)
 
diff --git a/tests/flask_tests.py b/tests/flask_tests.py
@@ -306,6 +306,20 @@ def index():
         assert 'domain=.example.com' in rv.headers['set-cookie'].lower()
         assert 'httponly' in rv.headers['set-cookie'].lower()
 
+    def test_session_using_server_name_and_port(self):
+        app = flask.Flask(__name__)
+        app.config.update(
+            SECRET_KEY='foo',
+            SERVER_NAME='example.com:8080'
+        )
+        @app.route('/')
+        def index():
+            flask.session['testing'] = 42
+            return 'Hello World'
+        rv = app.test_client().get('/', 'http://example.com:8080/')
+        assert 'domain=.example.com' in rv.headers['set-cookie'].lower()
+        assert 'httponly' in rv.headers['set-cookie'].lower()
+
     def test_missing_session(self):
         app = flask.Flask(__name__)
         def expect_exception(f, *args, **kwargs):
