[ChiragAgg5k]

Unity’s managed cookie container selects cookies using only the host and path. A cookie marked Secure can therefore be attached to an HTTP request, including when selfSigned is enabled.

The client now passes the full request URI. Secure cookies are selected only for HTTPS; ordinary cookies keep their current HTTP/HTTPS behavior. HTTP filtering retains Secure cookies for future HTTPS requests. Existing host/path overloads remain available and conservatively omit Secure cookies because they cannot establish the transport; callers needing Secure cookies should use the new URI overloads.

Validation:

• Eleven NUnit cases compile and exercise the generated CookieContainer directly: scheme/port combinations, legacy calls, retention, persistence, domain/path/expiry, and invalid URIs. The portable harness adapts Unity storage/logging and JSON settings; it does not replace cookie-selection logic. The Unity validation job now runs it without an editor license.
• The unmodified baseline fails the transport regression by returning ordinary=plain; session=synthetic-secret where only the ordinary cookie should be selected.
• Native Unity E2E now checks the HTTP mock server rejects the Secure cookie, then accepts a non-Secure replacement on the same endpoint. Native harness failures propagate instead of being masked by result.txt.
• Regenerated Unity; generated whitespace check, targeted PHPStan, PHPCS, Rector and Twig lint pass. Generation suite: 170 tests / 2,175 assertions (four existing skips).

Native Unity execution could not run locally: the installed editor has no valid headless license. The repository already disables its Unity editor CI job for the same licensing limitation. The portable tests pass; the native integration assertions are included for execution when licensing is restored.

Tracked in appwrite-labs/cloud#6887. Cookie-value logging and broader hardening remain in the separately owned #2131.

[hansi-codes]

🟢 Tier S · Ready to merge

This change adds URI-aware cookie selection so Secure cookies are included only for HTTPS requests, while keeping the legacy host/path overloads available. It also adds portable NUnit coverage and extends the Unity integration test to verify Secure-cookie rejection over HTTP.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 9

File	Change
.github/workflows/validation.yml	Runs the portable cookie transport tests in Unity validation.
templates/unity/Assets/Runtime/Core/Client.cs.twig	Passes the full request URI to cookie selection.
templates/unity/Assets/Runtime/Core/CookieContainer.cs.twig	Adds URI overloads and filters Secure cookies by HTTPS transport.
tests/e2e/Unity2021Test.php	Copies the cookie transport test into the Unity test project.
tests/e2e/languages/unity/CookieTransport/.gitignore	Ignores local .NET test build artifacts.
tests/e2e/languages/unity/CookieTransport/CookieTransport.csproj	Defines a portable NUnit project for the generated cookie container.
tests/e2e/languages/unity/CookieTransport/UnityStorageStub.cs	Provides storage and logging adapters for portable tests.
tests/e2e/languages/unity/CookieTransportTests.cs	Tests scheme-aware selection, retention, persistence, and URI validation.
tests/e2e/languages/unity/Tests.cs	Checks that an HTTP request omits a Secure cookie and accepts a plain replacement.

---

_{Reviewed 484c16d · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🔵 Tier A · Looks good to merge. Summary