208110 - no semicolon delimiter after "path=/" (worked until 1.3.1)

Status: RESOLVED DUPLICATE of bug 250859

(Core :: Networking: Cookies, defect)

Description

[Ariel Tankus]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4b) Gecko/20030507

When I try and login, the site writes a message saying I should
login via the home page and not from anywhere else (even though
that's exactly what was done.
   mozilla-1.3.1 logs in okay.


Reproducible: Always

Steps to Reproduce:
1. Go to the above URL.
2. Enter login information.
(One needs a login for that...)


Actual Results:  
I receive a message from the other side, that I should login
from the entrance page.  That's exactly what was done.
Following that I receive two buttons, both of which kicks me out
of the site.



Expected Results:  
mozilla-1.3.1 results in a correct login.

Cookies:  Enable all cookies.
          Disable cookies in Mail and News groups.

Scripts&Plugins:  Enable JavaScripts for Navigator (only).
                  Allow scripts to:  Everything is checked (7 items checked).
                  Enable Plugins for: Mail & Newsgroups. (checked)

cookies log:
=-=-=-=-=-=-
16384[8099f88]: ===== COOKIE SENT =====
16384[8099f88]: request URL: http://www.openoffice.org/branding/favicon.ico
16384[8099f88]: cookie string: LASTORDER=issues.priority%2C%20issues.issue_type
16384[8099f88]: current time: Tue Jun 03 13:36:45 2003 GMT
16384[8099f88]:
16384[8099f88]: ===== COOKIE ACCEPTED =====
16384[8099f88]: request URL: https://hb.leumi.co.il/cgi-bin/user_admin.cgi
16384[8099f88]: cookie string:
ASSESSION10=5A79F2E59943DD95C4E231F31AD2A86F251A0CDBB22E1F4D25C52EA; path=/ secure
16384[8099f88]: current time: Tue Jun 03 13:37:25 2003 GMT
16384[8099f88]: ----------------
16384[8099f88]: name: ASSESSION10
16384[8099f88]: value: 5A79F2E59943DD95C4E231F31AD2A86F251A0CDBB22E1F4D25C52EA
16384[8099f88]: host: hb.leumi.co.il
16384[8099f88]: path: / secure
16384[8099f88]: expires: at end of session
16384[8099f88]: is secure: false
16384[8099f88]:

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

I should add, that before the login, mozilla issues a popup about exipration
of site certificate, which I accepted for this session.
This happens in 1.3.1 as well, and makes no problem there.

Comment 1

[Ariel Tankus]

At [e-mail] request, bug assigned.

Comment 2

[[e-mail]]

16384[8099f88]: cookie string:
ASSESSION10=5A79F2E59943DD95C4E231F31AD2A86F251A0CDBB22E1F4D25C52EA; path=/ secure

parser problem - there's no semicolon delimiter after "path=/". the parser
allows spaces in token names & values.

the only way to fix this would be to allow spaces only in tokens which might
require it (NAME, VALUE, expires, ...), which will add complexity.

reporter: does IE work with this site?

Comment 3

[Ariel Tankus]

Unfortunately, I must say IE works far better than mozilla for this site.
Some parts of the screen do not appear in mozilla (including earlier versions
like 1.3.1 or older).
   To be even more precise, I'd say, this is the old site.
The new site (accessible via https://hb2.bankleumi.co.il/H/Login.html)
does not render with mozilla at all.  When I asked the site's support,
they referred me to the old one (I guess they keep it for non-IE users...).

See my bug 99591.

[To state it in a different way:  The site was built for IE.]

Comment 4

[[e-mail]]

so you're saying IE works correctly with the login? (i'm only interested in the
cookie problem here)

Comment 5

[Ariel Tankus]

Yes, IE works correctly with the login.

Comment 6

[[e-mail]]

ugh, this is gonna be ugly to fix.

darin, alecf: any opinion on what we should do here - site evang, or patch the
parser? i'm not partial to bloating our code just to fix sites that really are
doing stupid things.

(i think darin's still away, so cc'ing alecf)

Comment 7

[Olivier Cahagne]

do other browsers (such as Opera 7 or NS4.x) accept this cookie too ?

Comment 8

[Ariel Tankus]

Netscape Communicator 4.79 accepts the cookie (I just verified).

I don't have access to opera to check this.

Comment 9

[Olivier Cahagne]

kw: +4xp (even it's not in the spec :/ )

Comment 10

[Eli]

When trying to login at https://hb.leumi.co.il/H/Login.html the site tells me
that the login has time out. This happens since I installed 1.4x . all previous
versions from 1.1x worked fine.

Comment 11

[[e-mail]]

Eli: it's probably not the same bug... but, can you create a cookie log for the
login (instructions at http://bugzilla.mozilla.org/show_bug.cgi?id=193951#c1)
and attach it here?

Comment 12

[benc]

Is this the only site w/ the problem? We should try to see if they are using a
certain web development package or server.

Comment 13

[Ariel Tankus]

I saw rc2 has no fix for this.  Does this mean 1.4 is going to be released w/o
any fix?

Now regarding site evang.:  I think it is not a correct policy to try and
convince sites to change their behavior.  This is not because these sites are
right.  On the contrary, it's very bad that they don't conform to the standards.
The question is: what is mozilla going to earn from this policy?
If sites cannot be rendered correctly on mozilla, people who have the option
(i.e., M$ users) are going to turn to IE.  Linux users (like myself) are going
to have no choice but get frustrated any time a site need to be rendered in IE.
The site owners, on the other hand, have the majority of people using IE, so
they don't care about Linux users so much.
    Therefore, a much better policy IMHO would be to try and make as much sites
as possible work (and I don't write this only because of the site I can't use).
That's the only way I see, where mozilla could effectively compete IE, because
if people prefer IE, and sites cannot be rendered with mozilla, what good would
come out of the site evangelism?
    It would be better to be smart than just.

Comment 14

[zug_treno]

Is bug 250859 related to this bug?