137979 - Flash XML.load() method refuses to send cookie in "strict" mode

Status: VERIFIED FIXED

(Core :: Networking: Cookies, defect)

Description

[Johannes la Poutre]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.0rc1) Gecko/20020416
BuildID:    2002041617
Flash version: 6.0

The cookie http header is not sent from Flash's load() method on XML objects, if
the setting "Enable cookies for originating server only" is in effect. 

Setting the "Enable all cookies" prefernce resolves this problem. However, all
requests to this server need the cookie and still work with the strict
preference turned on.

I can *not* provide a publicly accessible URL (Sorry! The offending page is on
our intranet) - so a thorough description instead.



Reproducible: Always
Steps to Reproduce:
1. Go to any page on "my.host.com"
2. You are presented with a page to select a preference.
3. This page sets a persistent cookie for the top domain: ".host.com"
4. All subsequent requests to any page on "my.host.com" display right away (the
*server* checks for- and sets the cookie, no JavaScript).
5. One page contains a Flash object, which loads a xml file:
xmlObj.load("http://my.host.com/path/file.xml");
6. This used to work until somewhere between release 0.9.7 and 0.9.9+
7. From the server's error_log I can see the request being redirected to the
"set cookie page"
8. Conclusion: there is no cookie being sent to the server
9. Setting cookie preference "Enable all cookies" solves the problem.

Bottom line: Flash's get() method appears to be more restricitve than Mozilla's
native page requests. 
This behaviour is influenced by Mozilla's cookie handling logic (through the
cookie preference settings).

The same behaviour is found on Linux RH 6.2 / Build 2002041617 /Flash 5.0
MSIE 5.5 / Win NT 4.0 / Flash 6.0 works OK

One more note: I also considered bugs
http://bugzilla.mozilla.org/show_bug.cgi?id=129717
http://bugzilla.mozilla.org/show_bug.cgi?id=134625
but these don't mention any relationship with Flash or other plugins.

Comment 1

[Boris Zbarsky [:bzbarsky]]

confirming so this gets some attention

Comment 2

[Stephen P. Morse]

Although the symptoms are different, the patch just posted to bug 137079 will 
probably fix this bug as well.  Can someone who can reproduce this bug please 
apply that patch and see if it takes care of this problem.

Comment 3

[Peter Trudelle]

Nav triage team needs info: Does this happen on top sites?  What is the impact
on target users?

Comment 4

[Stephen P. Morse]

The impact of this one instance is small.  But see the discussion in bug 137079.  
Although the symptoms there are different, the fix for that bug will fix many 
other bugs as well, this probably being one of them.

Comment 5

[Stephen P. Morse]

Being marked fixed since the patch for 137079 is checked in on trunk.  However 
it is not yet fixed on the branch.

Comment 6

[Tom Everingham]

verified trunk and branch - fix to 137079 was checked in already