210490 - Cookies with empty path ("Path=") are handled differently than before

Status: RESOLVED WONTFIX

(Core :: Networking: Cookies, defect)

Description

[André Dahlqvist]

I have talked to dwitte on IRC about this, and he asked me to assign it to him.
When clicking on the link "här" on the site http://www.veckrevyn.com/ you are
sent a cookie containing "Path=". With current builds, this causes you to be
thrown back to the same page again, while in prevoius builds you were allowed in
on the site. Dwitte produced a patch that added a check for empty Path, and made
us default to root ("/") if such a Path was found in the cookie. That change
allowed me to enter the site.

The above site is quite unimportant, but it is possible that other more
important sites were broken by the increased strictness how an empty Path is
handled.

Comment 1

[André Dahlqvist]

I got the URL wrong in the above post - it should be http://www.veckorevyn.com/

Comment 2

[benc]

So you are saying we used to treate:

Path= -> Path=/

and now we treate it as the current base path?

If you can, please change the summary to describe the behavior you think is
incorrect.

Comment 3

[Libor Pavlík]

I found this bug too at http://tiscali.cz/home/ (Tiscali 10.0 login).
I parsed the login way and found the reason ... exactly as written i comment #2.

older mozilla (and also IE) Path= -> Path=/
mozilla 1.4 (Win2000) Path= -> current base path

Opera 6.06 works the same way as mozilla 1.4.

Comment 4

[[e-mail]]

Reassigning to nobody. If anyone wants to work on this, feel free!