Don't store `Set-Cookie` responses by default (cookie leak risk)

[u5surf]

Problem

Souin caches responses carrying Set-Cookie without stripping it, as long as they're otherwise cacheable. The stored Set-Cookie is then replayed to every client hitting the same key — e.g. Cache-Control: public, max-age=60 + Set-Cookie: session=abc leaks one user's session to others. Set-Cookie is only dropped if the origin sends Cache-Control: no-cache="Set-Cookie".

Spec

Not a violation — RFC 9111 §7.3 says Set-Cookie "does not inhibit caching" and leaves control to the origin. But it's the well-known cookie-leak pitfall, and most CDNs/proxies strip it by default.

Proposal

Make the safe default: skip storing (or strip Set-Cookie before storing) responses that contain it, with an opt-in to keep current behavior.

@darkweak Open to this? Skip-store or strip-on-store preferred? Happy to PR.

[darkweak]

Hey @u5surf I don't really know if we have to just strip the header or consider it as not cacheable.

[u5surf]

Checked how the common reverse-proxy / CDN caches default on Set-Cookie:

• nginx proxy_cache: "If the header includes the Set-Cookie field, such a response will not be cached." → not cached.
• Varnish built-in VCL: if (beresp.http.Set-Cookie) { ... set beresp.uncacheable = true; } → not cached (hit-for-miss).
• Fastly: standard VCL does return(pass) on Set-Cookie; the readthrough cache excludes such responses → not cached.
• Cloudflare: lists "the Set-Cookie header exists" as a condition under which it does not cache → not cached.
• Apache mod_cache: stores it by default, but the docs recommend CacheIgnoreHeaders Set-Cookie to strip it.

So the prevailing default is treat as not cacheable (nginx, Varnish, Fastly, Cloudflare); stripping is only Apache's opt-in. I'd suggest matching the majority: don't store responses with Set-Cookie by default, with an opt-in config to strip-and-cache for users who want it (nginx splits these via proxy_ignore_headers Set-Cookie + proxy_hide_header Set-Cookie). Happy to send a PR.

Sources:

• nginx: https://nginx.org/en/docs/http/ngx_http_proxy_module.html
• Varnish: https://github.com/varnishcache/varnish-cache/blob/master/bin/varnishd/builtin.vcl
• Fastly: https://www.fastly.com/documentation/guides/concepts/edge-state/cache/cache-freshness
• Cloudflare: https://developers.cloudflare.com/cache/concepts/default-cache-behavior/
• Apache: https://httpd.apache.org/docs/current/mod/mod_cache.html

[darkweak]

I prefer to not store the response to prevent any leak without any opt-in.