Package org.asynchttpclient.cookie

Class PublicSuffixList

  • public final class PublicSuffixList
extends Object
    The ICANN section of the Mozilla Public Suffix List, used to decide whether a cookie Domain attribute names a registry rather than a site.

    RFC 6265 Section 5.3 step 5 requires rejecting a Domain that is a public suffix, and that rule cannot be approximated: co.uk has a dot like any ordinary domain, so counting labels does not distinguish a registry from a site. Without the list a host under co.uk can set a cookie for co.uk itself and every other host under that suffix receives it.

    Only the ICANN section is bundled. The private section describes organisations that let others register names beneath them, which is a weaker property than a registry and not what step 5 is about.

    Matching lowercases with Locale.ROOT. The default locale would be wrong here in a way that matters: under Turkish, "INFO".toLowerCase() is not info, so the check would answer false for every I-initial suffix and fail open exactly where it is meant to hold.

    The list is data and goes stale as registries change. A suffix added upstream after this release is not recognised until the bundled copy is refreshed, so this narrows the exposure rather than closing it for all time. If the resource cannot be read the check reports nothing as a public suffix, leaving behaviour as it was rather than rejecting cookies that used to work.

    • Method Detail

      • isPublicSuffix

        public static boolean isPublicSuffix​(String domain)
        Whether domain is a public suffix, and so may not be the Domain of a cookie.
        Parameters:
        domain - a hostname, without a leading dot