Sample
guzzlehttp/guzzle 8.0.2: Isolate host-only cookies without Domain attribute, truncate cross-origin redirect Referer headers to origin, restore BodySummarizer stream cursors on HTTP errors, and enforce RFC Max-Age precedence in guzzlehttp/guzzle 8
Verified sample for composer guzzlehttp/guzzle 8.0.2: Isolate host-only cookies without Domain attribute, truncate cross-origin redirect Referer headers to…
sha256:8a42f71c27f816717701cbf1aa7699e9e2fbdbacee2794f62e0f69614c60b7b9
This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured.
How many distinct signing keys filed a passing contract receipt. One is the author alone; more than one means somebody else built it too. A key is self-generated with nothing registered behind it, so it counts keys, not people.
MIT-0
Execution evidence
The declared environment and the signed runs are kept apart, so you can see exactly what this sample ran and where.
- Evidence basis
- Signed contract pass
- Verification receipts
- 2
- Signing keys that built it
- 2
Declared environment
php linux x64 php php composer
Verification-run environments
| Environment | Contract | Stages | Run |
|---|---|---|---|
| php 8 · linux alpine/x64 · docker ed25519:d91480838ac982c9 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · composer@1 |
2026-08-16 |
| php 8 · linux alpine/x64 · docker ed25519:2175b912ea1c23b1 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · composer@1 |
2026-08-18 |
Case
HOW- Goal
- Isolate host-only cookies without Domain attribute, truncate cross-origin redirect Referer headers to origin, restore BodySummarizer stream cursors on HTTP errors, and enforce RFC Max-Age precedence in guzzlehttp/guzzle 8
- Packages
- Symbols
-
- GuzzleHttp\Cookie\CookieJar::extractCookies
- GuzzleHttp\Cookie\SetCookie::getHostOnly
- GuzzleHttp\Cookie\SetCookie::isExpired
- GuzzleHttp\RedirectMiddleware
- GuzzleHttp\BodySummarizer
- GuzzleHttp\Psr7\UriComparator::isCrossOrigin
- Environment
- php
- Created
- 2026-08-16T08:35:06Z
Contract
- assert CookieJar::extractCookies marks cookies without Domain attribute as HostOnly and prevents sending them to subdomains
- assert CookieJar::extractCookies marks cookies with explicit Domain attribute as not HostOnly and sends them to subdomains
- assert RedirectMiddleware truncates cross-origin Referer header to origin only when referer option is enabled
- assert RedirectMiddleware preserves full path and query in same-origin Referer header
- assert RedirectMiddleware completely removes Referer header on HTTPS to HTTP scheme downgrade redirects
- assert BodySummarizer restores response body stream cursor position after formatting error message during ClientException
- assert SetCookie strictly prioritizes Max-Age=0 over future Expires attribute to mark cookie as immediately expired
- assert UriComparator::isCrossOrigin canonicalizes IPv6 bracketed hosts and treats alternate representations as same-origin
- assert Client preserves explicit request method casing verbatim without automatic normalization
Files
- NOTES.md
- composer.json
- composer.lock
- csx.json
- src/GuzzleVersionSemantic.php
- test/contract.php