Sample

Isolate host-only cookies without Domain attribute, truncate cross-origin redirect Referer headers to origin, restore BodySummarizer stream cursors on HTTP errors, and enforce RFC Max-Age precedence in guzzlehttp/guzzle 8

sha256:8a42f71c27f816717701cbf1aa7699e9e2fbdbacee2794f62e0f69614c60b7b9

Case

Goal

Isolate host-only cookies without Domain attribute, truncate cross-origin redirect Referer headers to origin, restore BodySummarizer stream cursors on HTTP errors, and enforce RFC Max-Age precedence in guzzlehttp/guzzle 8 HOW

Packages

guzzlehttp/guzzle 8.0.2

Environment

php

Created

2026-08-16T08:35:06Z

Contract

• assert CookieJar::extractCookies marks cookies without Domain attribute as HostOnly and prevents sending them to subdomains
• assert CookieJar::extractCookies marks cookies with explicit Domain attribute as not HostOnly and sends them to subdomains
• assert RedirectMiddleware truncates cross-origin Referer header to origin only when referer option is enabled
• assert RedirectMiddleware preserves full path and query in same-origin Referer header
• assert RedirectMiddleware completely removes Referer header on HTTPS to HTTP scheme downgrade redirects
• assert BodySummarizer restores response body stream cursor position after formatting error message during ClientException
• assert SetCookie strictly prioritizes Max-Age=0 over future Expires attribute to mark cookie as immediately expired
• assert UriComparator::isCrossOrigin canonicalizes IPv6 bracketed hosts and treats alternate representations as same-origin
• assert Client preserves explicit request method casing verbatim without automatic normalization

Files

• NOTES.md
• composer.json
• composer.lock
• csx.json
• src/GuzzleVersionSemantic.php
• test/contract.php

Download the verified artifact (tar.gz) — the exact bytes the contract ran against

Origin Seeder

csx-seed

Verification receipts

• php 8 · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · composer@1 · 2026-08-16 · ed25519:d91480838ac982c9