169538 - Mozilla ignores some cookies.

Status: VERIFIED DUPLICATE of bug 155768

(Core :: Networking: Cookies, defect)

Description

[Michael Schout]

User-Agent:       Mozilla/5.0 (X11; U; Linux i386; en-US; rv:1.2b) Gecko/20020918
Build Identifier: Mozilla/5.0 (X11; U; Linux i386; en-US; rv:1.2b) Gecko/20020918

Some http cookies are ignored by Mozilla.  This problem does NOT exist in the
mozilla 1.1 release, but it DOES exist in 1.2 alpha, as well as the latest
nightly build that I tested (2002091804).  Example page demonstrating the problem:

With "warn before accepting cookies" turned on:

go to https://testbed.gkg-com.com/protected/foo and you will get a login form. 
Click the "Login" button (you dont have to fill anything in because it will set
the cookie with an empty value with an invalid login), and you will be shown the
same page again, but you will never be warned that the site tried to set a cookie.

Now go to https://testbed.gkg-com.com/admin/logout and you will again get the
login form.  Click the "Login" button and you will get the warning that the site
wishes to set a cookie.  Both of these URL's have the same code behind them. 
The only difference is the cookie name that is getting set is different.  In the
first case, the cookie getting set is named "GKGDRS::TicketTool_Protected", and
the second uses a cookie named "GKGDRS::TicketTool_Admin".

The /admin area works in 1.2 alpha, but not the /protected area.  For some
reason mozilla doesnt see the GKGDRS::TicketTool_Protected cookie. In Mozilla
1.1, everything works just fine, so there must be some change since 1.1 that
causes this.

Reproducible: Always

Steps to Reproduce:
1. go to https://testbed.gkg-com.com/protected/blah
2. click "Login"
3. see that the browser never processed the Set-Cookie header.

Actual Results:  
Nothing.  You just get the login page back but moz never tells me that it saw a
cookie.

Expected Results:  
accepted the cookie.

Comment 1

[Pekka Nikander]

The Nordea netbanking site seems to suffer from this bug.  This is tested
on MacOS X 10.1.5 => need to change platform and os.
I would change severity to major since this causes loss of 
functionality for lots of users.  However, I don't have priviledges
to change severity, platform, or OS of other people's bugs.

Reproducible: always

To reproduce: 
1. Go to https://solo3.nordea.fi/cgi-bin/SOLO0001 
2. Give 123456 as Asiakasnumero (account id) and 1111 as Tunnus (passcode)
3. Click Hyväksy (Accept)

Actual results:
You get an error page stating
Http error 404: Session control information missing.  Temporary session Cookie
usage is required.

Expected results:
Enter the Nordea banking test try service, as you can do
with Mozilla 1.1 or 1.0

Comment 2

[Stephen P. Morse]

*** This bug has been marked as a duplicate of 155768 ***

Comment 3

[Tom Everingham]

verified duplicate