170508 - HTTP "Set-Cookie:" request specifying a path are not honored

Status: RESOLVED INVALID

(Core :: Networking: Cookies, defect)

Description

[David Santinoli]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2b) Gecko/20020924
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2b) Gecko/20020924

HTTP directives which set a cookie specifying a path are apparently ignored.

Reproducible: Always

Steps to Reproduce:
1. Have the browser process a HTTP response which sets a cookie specifying a
path, as in
 Set-Cookie: ctest=foo; path=/cookietest/

 I did it in PHP with
 setcookie("ctest","foo",0,"/cookietest/");

2. Request a page under the /cookietest directory on the same (virtual) host.
Actual Results:  
The ctest cookie value is not transmitted by the browser to the server.
You can also have a look at the "Stored cookies" box; ctest will not be there
either.

Expected Results:  
The proper cookie value should be transmitted to the server.

Tested on Mozilla 1.2a (on Linux, Mac OS X) and the latest nightly build
(Mozilla 1.2b = Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2b) Gecko/20020924)

This bug was *not* present on previous builds (e.g. Mozilla 1.1).

Comment 1

[Boris Zbarsky [:bzbarsky]]

David, is the page setting that cookie living in /cookietest/ ?

Comment 2

[David Santinoli]

No, in my example the cookie is set by a page at root level.

Comment 3

[Boris Zbarsky [:bzbarsky]]

In that case this is not a bug.  Setting a cookie for a directory that is
different from the one you live in is explicitly disallowed by the cookie RFC
and more to the point leads to serious security problems.  As a result, we have
purposefully disabled it.

Comment 4

[David Santinoli]

But shouldn't the path restrictions from RFC 2109 apply only for Version 1 cookies?
I'm inclined to think that without an explicit version specifier in the
Set-Cookie header requesting the new RFC-compliant behaviour, the user agent
should act the Netscape way.

Comment 5

[Stephen P. Morse]

I hate to say this, but we might have to back out the change that introduced the
path restrictions.  Looks like it breaks citibank.  See bug 156725.

Comment 6

[Boris Zbarsky [:bzbarsky]]

David, like I said: "more to the point leads to serious security problems". 
That's the real reason anything ever changes in cookies; any attempt to follow
the RFC for RFC's sake is pretty much doomed to failure due to the fact that
everyone and their mother violates it in any way they feel like.