From b0626fff8538e3dd4a52f148d91c8348d51d64d1 Mon Sep 17 00:00:00 2001
From: Carlos Garcia Campos <cgarcia@igalia.com>
Date: Fri, 27 Feb 2026 12:03:25 +0100
Subject: [PATCH] cookies: do not send cookies to a HTTP proxy for a HTTPS
 request

Closes #502
---
 libsoup/soup-cookie-jar.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/libsoup/soup-cookie-jar.c b/libsoup/soup-cookie-jar.c
index c8231f0..55c2a7b 100644
--- a/libsoup/soup-cookie-jar.c
+++ b/libsoup/soup-cookie-jar.c
@@ -15,6 +15,7 @@
 #include "soup-message-private.h"
 #include "soup-misc-private.h"
 #include "soup.h"
+#include "soup-connection.h"
 
 /**
  * SECTION:soup-cookie-jar
@@ -818,18 +819,27 @@ process_set_cookie_header (SoupMessage *msg, gpointer user_data)
 	g_slist_free (new_cookies);
 }
 
+static gboolean
+allow_cookies_for_request (SoupMessage *msg)
+{
+        /* Do not send cookies to a HTTP proxy for a HTTPS request */
+        return msg->method != SOUP_METHOD_CONNECT || !soup_connection_is_tunnelled (soup_message_get_connection (msg));
+}
+
 static void
 msg_starting_cb (SoupMessage *msg, gpointer feature)
 {
 	SoupCookieJar *jar = SOUP_COOKIE_JAR (feature);
-	GSList *cookies;
-
-	cookies = soup_cookie_jar_get_cookie_list_with_same_site_info (jar, soup_message_get_uri (msg),
-	                                                               soup_message_get_first_party (msg),
-							               soup_message_get_site_for_cookies (msg),
-								       TRUE,
-							               SOUP_METHOD_IS_SAFE (msg->method),
-							               soup_message_get_is_top_level_navigation (msg));
+	GSList *cookies = NULL;
+
+	if (allow_cookies_for_request (msg)) {
+		cookies = soup_cookie_jar_get_cookie_list_with_same_site_info (jar, soup_message_get_uri (msg),
+	                                                                       soup_message_get_first_party (msg),
+							                       soup_message_get_site_for_cookies (msg),
+								               TRUE,
+							                       SOUP_METHOD_IS_SAFE (msg->method),
+							                       soup_message_get_is_top_level_navigation (msg));
+	}
 	if (cookies != NULL) {
 		char *cookie_header = soup_cookies_to_cookie_header (cookies);
 		soup_message_headers_replace (msg->request_headers, "Cookie", cookie_header);
-- 
2.33.0