276877 - cookie broken for www and blank

Status: VERIFIED INVALID

(Core :: Networking: Cookies, defect)

Description

[steve200]

apologies if this is already covered, I really did try to find this error in the
existing bugs.

if www.somesite.com and somesite.com both have A records to the same webserver
and that webserver is configured with www.somesite.com and somesite.com as valid
host headers of the same logical website, internet explorer cookies do not
distinguish between the two.  Firefox does distinguish them, somesite.com and
www.somesite.com each have their own separate cookies.  Firefox breaks
session-based logins where the site is somewhat careless about using
www.somesite.com or not using somesite.com.

Comment 1

[Mike Connor [:mconnor]]

That's the flaw in IE's implemenation.  www.somesite.com and somesite.com are
explicitly allowed to have separate host cookies per the appropriate RFCs.  How
do you know that somesite.com and www.somesite.com are even the same site? 
Really, you don't, even though its expected.

This is not an error, this is how the RFC that defines cookies says this should
be handled.