115623 - Expiry date on cookies not parsed/displayed correctly

Status: VERIFIED WORKSFORME

(Core :: Networking: Cookies, defect)

Description

[Chris Underhill]

Build 2001121308-trunk on Linux 2.4.12 (Red Hat 7.1 + updates). Similar problem
exists with all earlier versions that I have on Linux since (at least) 0.9.3.

Site in question sets a cookie which should expire in 10 minutes via a
Set-cookie header, e.g. running (at 16:16:27 on 2001/12/17)

openssl s_client -connect www.mybroker.co.uk:443 -state -debug

and entering "GET / HTTP/1.0\r\n" I see the (all on the same) line:

Set-Cookie: MYBROKER_SESSION=698b3f6f8fb254a9e5e115753c2595c9; expires=Mon,
17-Dec-2001 16:26:28 GMT; path=/; secure

If I then visit the site with Mozilla, and then view stored cookies, the cookie
in question has an expiry date:

Tue 18 Dec 2001 16:29:51 GMT 16:29:51

i.e., one day out and no explanation of the why there is an additional time
shown. The server logs indicate the expiry date in the header was:

Mon, 17-Dec-2001 16:29:50 GMT

In the cookie.txt file the timestamp field is 1008606591 which is almost
correct. Client and server are synchronised to the same NTP server. Viewing the
cookie's expiry date with IE4 (or higher) on NT results in the correct date
being shown, as does Netscape 4.78 on Linux.

Comment 1

[Stephen P. Morse]

This is working fine for me on a win NT platform.

Are you sure you had the correct date on your client machine?  Recall that the 
cookie manager corrects for time-zone differences by comparing the current 
client date to the current server date.  So if there is a day descrepancy 
between them, the cookie will be set wrong by a day.

Comment 2

[Chris Underhill]

As I wrote client and server are sync-ed to the same NTP server and the dates
are both identical. Running date (as near as I can) simultaneously on both
machines shows an identical time (and timezone). The displayed expiry date is
correct with Linux Netscape 4.78, it's just a day out with Linux Mozilla.

Comment 3

[Stephen P. Morse]

Is this a linux-only problem or can you reproduce it on a win32 box?

Comment 4

[Stephen P. Morse]

bzbarsky, when you confirmed it, were you also running on a linux box?  Can you 
try it on a win32 box and see if you can reproduce it there?

Comment 5

[Chris Underhill]

I'v just tried with Mozilla build 2001121703 on NT 4.0sp5 and the cookie's
expiry date is shown correctly, in this case as

18 December 2001 10:33:27

so this looks like a Linux-specific bug.

Comment 6

[Stephen P. Morse]

This is working fine for me now on both win32 and on linux.  Here is what I am 
seeing:

1 go to https://www.mybroker.co.uk
  see a cookie set for friday Feb 8, 2002, ten minutes in the future
  remove that cookie

2 go to http://www.mybroker.co.uk (note this is http instead of https)
  see a cookie set for saturday Feb 8, 2003, one year in the future

This behavior is consistent on both platforms.  Furthermore, the debugger shows 
me that these are indeed the dates that appear on the set-cookie headers.

So either this bug got fixed by some other checkins.  Or possibly user was doing 
http when he meant to do https, saw that it was saturday instead of friday, and 
concluded that cookie was being set one day out.  I mention this second 
possiblity because that is what I was doing in my testing just now, and for a 
moment I thought I was seeing the bug, but of couse I wasn't.

Closing out as wfm.  If you are still seeing the problem, then reopen.

Of course I'm still seeing the time twice in the date string, but that's bug 
119013.

Comment 7

[Tom Everingham]

verified:  Linux rh6 02/15/02 build