147638 - Session cookies getting an extra "."

Status: VERIFIED INVALID

(Core :: Networking: Cookies, defect)

Description

[bear_phillips]

When I try to set a session cookie for say members.aafp.org , mozilla rc3 adds
and extra "." at the beginning of the domain, set the cookie is set for
".members.aafp.org" .  Mozilla .98 (and probably .99) do not have this problem.

I set up a test script at:
http://members.aafp.org/cgi-bin/moztest.pl

Not all session cookies seem to get the extra ., so I am not sure why it happens
in this case.

Comment 1

[bear_phillips]

Here is a better worded comment.

The domain for the session cookie shows up as ".members.aafp.org" instead of
"members.aafp.org".

Comment 2

[Stephen P. Morse]

A domain attribute for a cookie must always start with a leading dot.  See 
RFC2109.

There are some websites that were setting cookies with a "domain=" attribute and 
specifying an invalid domain -- i.e., one that did not start with a dot.  Those 
sites were not working properly, and the cause was the site and not mozilla.

To be kinder to those sites, mozilla will append the missing dot, thereby 
overlooking the syntax error made by the site.  That is the dot that you are 
seeing.  (This was a recent change made to mozilla.)

This has nothing to do with session cookies -- it is true for permanent cookies 
as well.

Comment 3

[Tom Everingham]

verified invalid

Comment 4

[Stephen P. Morse]

See also bug 147987 which was marked invalid for the same reason.