1337774 - history.pushState does not read cookies from same origin

Status: UNCONFIRMED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Christos Alewa]

Attachment: pushState_bug.7z

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Build ID: 20170125094131

Steps to reproduce:

We have a testing environment, in which we try to read a cookie from same origin (domain,sub domain,etc) but different path.
Test case is attached as zip folder.






Actual results:

It does not read the cookie at all.


Expected results:

When pushing the button on site2, the cookies of site1 should be displayed on the console.

Comment 1

[Andrew Overholt [:overholt]]

Anne, can you take a quick look and see if we're not confirming to the spec here? Thank you.

Comment 2

[Anne (:annevk)]

I can't open this resource, but I know from https://github.com/whatwg/html/issues/332 that Gecko uses an "origin URL" concept for cookies, that likely isn't affected by pushState() and can't be.

Christos, does this work in other browsers?

Comment 3

[Andrew Overholt [:overholt]]

(Needinfo for comment 2) And Christos, if you could host your example somewhere it'd make it easier for people to investigate (instead of the .7z attachment). Thank you!

Comment 4

[Christos Alewa]

Attachment: pushState_failure.7z

It is only working on Internet Explorer, Chrome, Firefox and Safari apparently do not implement pushState correctly.

Unfortunately i cannot host it anywhere, nevertheless, in order for anyone to investigate the issue, just upload the 2 directories to a webserver and navigate to the sites and check the console output.

I hope this is helpful.
Thanks and greetings,
Christos

Comment 5

[Loic]

Attachment: site1.html

Comment 6

[Loic]

Attachment: site2.html

Comment 7

[Loic]

It seems to work for me with FF52.

site1:
1) create cookie
--> cookie set
2) print own cookies
--> "cookie.location: https://bug1337774.bmoattachments.org/attachment.cgi?id=8852895"
--> all cookies on this site: name1=value1

site2:
1) print own cookies
--> all cookies on this site: name1=value1
2) print site1 cookies
--> "cookie.location: https://bug1337774.bmoattachments.org/attachment.cgi?id=8852895"
--> all cookies on site1: name1=value1

Could you confirm? If it's wrong, which expected result should be displayed?

Comment 8

[Christos Alewa]

The problem here is that you are in the same directory and you can always read cookies from the same directory.
On site2, printing own cookies should not display anything (since site2 has no cookies set).

Comment 9

[Loic]

Ok, I see, when using different directories (paths), there is a security error message on site2.

Comment 10

[Christos Alewa]

The domain must be the same like for example:

http://foo.com/bugreport/path1/site1.html
http://foo.com/bugreport/path2/site2.html

The pushState command then just needs the /bugreport/path1/site1.html in order for it to work.