>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3586450. --> Reported by: [eduardo morales alberti](https://www.drupal.org/user/3546420) Related to !18 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>In <code>\Drupal\fast404\Fast404::extensionCheck</code>, the session check intended to bypass fast 404 for authenticated users iterates over cookie values instead of cookie keys (names). Because Drupal session cookies are identified by their name starting with <code>SESS</code> (or <code>SSESS</code> over HTTPS), checking the value produces a false negative, and the bypass never triggers.</p> <p>Affected code: \Drupal\fast404\Fast404::extensionCheck</p> <pre>&nbsp;&nbsp;&nbsp; // Check to see if the URL is that of an image derivative.<br>&nbsp;&nbsp;&nbsp; // If this file does not already exist, it will be handled via Drupal.<br>&nbsp;&nbsp;&nbsp; if (strpos($path, 'styles/')) {<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // Check to see if we will allow anon users to access this page.<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (!Settings::get('fast404_allow_anon_imagecache', TRUE)) {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; $cookies = $this-&gt;request-&gt;cookies-&gt;all();<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // At this stage of the game we don't know if the user is logged in via<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // regular function calls. Simply look for a session cookie. If we find<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // one we'll assume they're logged in.<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (isset($cookies) &amp;&amp; is_array($cookies)) {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; foreach ($cookies as $cookie) {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (stristr($cookie, 'SESS')) {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // We're allowing anyone to hit non-existing image derivative URLs<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // (default behavior).<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; else {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>&nbsp;&nbsp;&nbsp; }</pre><p>The variable <code>$cookie</code> holds the cookie <em>value</em> (the session token), not the cookie <em>name</em>. The <code>SESS</code> prefix never appears in the value, so an authenticated user is never detected and the request proceeds to the fast 404 check.</p> <h4 id="summary-steps-reproduce">Steps to reproduce</h4> <ol> <li>Configure fast 404 to block image derivative extensions, for example .webp<br> <pre>$settings['fast404_exts'] = '^(?!/robots)^(?!/system/files).*\.(txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp|webp)$'; <br> $settings['fast404_allow_anon_imagecache'] = FALSE;</pre></li> <li>Log in as any authenticated user (a valid <code>SESS*</code> cookie is set in the browser).</li> <li>Create or upload a Media image entity that triggers generation of a WebP image style derivative.</li> <li>Observe that the derivative request returns a fast 404 instead of triggering on-demand image generation.</li> </ol> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Iterate over the cookie <em>keys</em> instead of values so the <code>SESS</code> / <code>SSESS</code> prefix is matched against the cookie name:</p> <pre>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; foreach (array_keys($cookies) as $cookie) {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (stristr($cookie, 'SESS')) {<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; }<br> </pre><h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Add a unit test that asserts <code>extensionCheck</code> returns early when a cookie named <code>SESS</code></li> </ul> <h3 id="summary-ui-changes">User interface changes</h3> <p>None.</p> <h3 id="summary-api-changes">API changes</h3> <p>None.</p> <h3 id="summary-data-model-changes">Data model changes</h3> <p>None.</p>