236497 - Make charting work without cookies

Status: RESOLVED WONTFIX

(Bugzilla :: Reporting/Charting, defect)

Description

[Gervase Markham [:gerv]]

Currently, charting doesn't work without cookies, because the image request
doesn't carry URL parameters (see bug 235510 for why this was done.)

We could solve this with a general token-issuing system, which allowed a token
to authenticate any one request. This also could be used to fix bug 38862.

Gerv

Comment 1

[Frédéric Buclin]

gerv: do we really use cookies to display an image??

Comment 2

[Gervase Markham [:gerv]]

Using charting requires a user to be a member of the chartgroup - which includes accessing the image. So accessing an image requires the user to be logged in, which requires cookies.

We could fix this using the token system (which didn't exist when charting was written) or by removing the necessity to log in to use charts. Except that if requirelogin was on, we'd still have the problem.

Do we have a problem these days with requiring cookies?

Gerv

Comment 3

[Frédéric Buclin]

(In reply to Gervase Markham [:gerv] from comment #2)
> Using charting requires a user to be a member of the chartgroup - which
> includes accessing the image. So accessing an image requires the user to be
> logged in, which requires cookies.

Ah ok. So we simply require the user to be logged in as for any other admin page. I thought you meant another, separate cookie used just for that, which is why I was wondering.


> Do we have a problem these days with requiring cookies?

We don't require cookies, we simply require the user to be logged in. So I don't see any problem here. This bug is wontfix to me.

Comment 4

[Gervase Markham [:gerv]]

We are requiring cookies.

The no-cookie use method of Bugzilla requires you to log in every time you do an operation requiring a login. Loading the chart page is one such operation; loading the image is another. But we don't load the image in an <iframe>, we load it as an <img> tag - but without cookies, the request comes back as a login page, which <img> can't read, and just says "broken image".

That's the problem.

If we are happy requiring cookies to use charts, this is WONTFIX. Otherwise, we would need to convert to using the token system.

Gerv

Comment 5

[Frédéric Buclin]

Closing as WONTFIX. I still don't understand which issue you try to fix here. And no reason charts should require a different approach than any other page in Bugzilla.

Comment 6

[Gervase Markham [:gerv]]

The point, just for the record, is that it's generally "possible" to use Bugzilla with cookies turned off. It just means you need to re-login every time you make a change. But this doesn't work for charts - when you load a chart, it gets you to relogin to display the chart HTML, but it can't load the chart image, as that's a separate load and so hits an auth prompt instead of loading.

However, given that browsers now offer domain-based cookie control, I think that we should no longer work to support the no-cookies option. So WONTFIX is correct.

Gerv