33399 - "allow cookies sent to originating server" behaves surprisingly

Status: RESOLVED WORKSFORME

(Core :: Networking: Cookies, defect, P3)

Description

[[e-mail]]

This actually came from a Slashdot discussion, but I was so surprised by it I
checked it out myself.  "Allow cookies sent to originating server" sounds like
it would disallow the situation where, for instance, a Doubleclick GIF sends a
cookie to Doubleclick on a page that comes from somewhere else.

In fact, that doesn't work.  In the above case, the "originating server" would
be the originating server for the gif rather than the server from which the page
came.

I suggest either making it work like people would expect, or adding a new cookie
item, "only allow cookies that get sent to the server that sent the page".

(Please ingore the user-agent. :-))

Comment 1

[Stephen P. Morse]

The way you described it is indeed the way it is supposed to work.  And, as far 
as I know, it does work that way.  So I have to close this out as works-for-me.

If you have a concrete example that doesn't work, and you can describe it in a 
step-by-step manner, than please do so and reopen this report.