Patched code sample

import asyncio
from aiohttp import web, ClientSession

# This server represents a malicious, third-party site.
async def attacker_handler(request):
    """
    Receives the redirected request. We check if the sensitive cookie
    was forwarded here.
    """
    print("\n--- Attacker Server Received Request ---")
    cookie_header = request.headers.get("Cookie")
    if cookie_header:
        print(f"!!! VULNERABILITY EXPLOITED: Leaked cookie: {cookie_header}")
    else:
        # This is the expected outcome when the fix is applied.
        print(">>> FIX VERIFIED: No cookie was leaked to the attacker.")
    return web.Response(text="Hello from attacker")

# This server represents the initial, trusted site.
async def legitimate_handler(request):
    """
    Receives the initial request and redirects to a cross-origin
    attacker-controlled site.
    """
    print("\n--- Legitimate Server Received Request ---")
    print(f"Cookie received: {request.headers.get('Cookie')}")
    # This redirect is the core of the vulnerability scenario.
    raise web.HTTPFound(location="http://127.0.0.1:8081/catch")

async def main():
    # Setup the attacker's server
    attacker_app = web.Application()
    attacker_app.router.add_get("/catch", attacker_handler)
    attacker_runner = web.AppRunner(attacker_app)
    await attacker_runner.setup()
    attacker_site = web.TCPSite(attacker_runner, '127.0.0.1', 8081)
    await attacker_site.start()

    # Setup the legitimate server
    legit_app = web.Application()
    legit_app.router.add_get("/", legitimate_handler)
    legit_runner = web.AppRunner(legit_app)
    await legit_runner.setup()
    legit_site = web.TCPSite(legit_runner, '127.0.0.1', 8080)
    await legit_site.start()

    print("--- Servers Started ---")
    print("Legitimate: http://127.0.0.1:8080")
    print("Attacker:   http://127.0.0.1:8081")

    # --- DEMONSTRATION OF THE FIX/WORKAROUND ---
    # The CVE description states that using a manual 'Cookie' header in the
    # 'headers' parameter is not vulnerable, as this bypasses the flawed
    # automatic cookie handling for redirects in older versions.
    # This code demonstrates that safe pattern.
    print("\n--- Client making request with the FIX (manual Cookie header) ---")
    safe_headers = {'Cookie': 'session_id=my_very_secret_token'}

    async with ClientSession() as session:
        try:
            async with session.get(
                "http://127.0.0.1:8080/",
                headers=safe_headers,
                allow_redirects=True
            ) as response:
                print(f"\nClient received final response from: {response.url}")
                print(f"Final status: {response.status}")
        except Exception as e:
            print(f"An error occurred: {e}")

    # Cleanup
    await attacker_runner.cleanup()
    await legit_runner.cleanup()
    print("\n--- Servers Stopped ---")

if __name__ == "__main__":
    # In a vulnerable version of aiohttp, using `cookies={'session_id': ...}`
    # would leak the cookie. This code shows the safe alternative.
    # An updated aiohttp (>=3.14.0) would also prevent the leak even with the
    # `cookies` parameter.
    try:
        asyncio.run(main())
    except KeyboardInterrupt:
        print("\nInterrupted by user.")