361659 - Multiple cookies set with one header results in incorrect domain set for 2nd cookie (eg co.uk)

Status: RESOLVED WORKSFORME

(Core :: Networking: Cookies, defect)

Description

[Tom Pike]

Steps to reproduce:

1) Open a clean browser window
2) Go to http://www.strathmashie.co.uk/cookietest.php
3) Confirm that the cookie array is empty.  Refresh if you want to be really sure.
4) Go to http://www.paypal.co.uk/
5) Return to http://www.strathmashie.co.uk/cookietest.php
6) Witness that there is now a visible cookie
7) Check Options -> Privacy -> Show cookies
8) Find an entry for "co.uk"
9) Verify that this is the same cookie you saw on step 6

Expected result:

No cookie should be shown in step 5 and no cookie for "co.uk" should be visible in the cookie manager.

Tested and confirmed to be broken on:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1) Gecko/20061010 Firefox/2.0
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061123 Minefield/3.0a1

Paypal.co.uk is setting its cookies with the following HTTP header according to LiveHTTPheaders (though this has been confirmed to behave the same if LiveHTTPheaders is not installed):

Cookie: Apache=xxx.xxx.xxx.xxx.yyyy1157558931646; s_sess=%20s_cc%3Dtrue%3B%20s_refresh%3DHomepage%257E%255B1%255D%3B%20s_sq%3D%3B

(some details in cookie hidden to protect the innocent)

This results in the following 2 cookies being stored:

Name: Apache
Content: xxx.xxx.xxx.xxx.yyyy1157558931646
Host: www.paypal.co.uk
Path: /
Send For: Any type of connection
Expires: 29 August 2036 17:08:52

Name: s_sess
Content: %20s_cc%3Dtrue%3B%20s_refresh%3DHomepage%257E%255B2%255D%3B%20s_sq%3D%3B
Domain: .co.uk
Path: /
Send For: Any type of connection
Expires: at end of session

Comment 1

[Jesse Ruderman]

CCing people who seem to be active in cookie code.

Comment 2

[[e-mail]]

i can't reproduce this by following the steps in comment 0, although there shouldn't have been any changes in the codebase between 1.9a1 and now that affected this. it's possible we need an updated testcase.

Comment 3

[[e-mail]]

from the cookie log it appears paypal sets the Apache= cookie as before, but specifies a ".paypal.co.uk" domain for the s_sess one, which we handle correctly. need an updated testcase.

Comment 4

[[e-mail]]

i'd note that in comment 0, the "Cookie:" header shown is actually the response mozilla is sending back to the server, not the original "Set-Cookie:" header the server used to set the cookies. so there's not enough information here to figure anything out, unfortunately :(

Tom, can you help out with a new testcase/more details here?

Comment 5

[Tom Pike]

Yes, I've been trying in vain to reproduce it myself.  The original bug report I filed did indeed note the header sent by Mozilla rather than the server (my mistake) which means it's quite possible that the fault was entirely on PayPal's end.  I have tried many possible combinations of headers without success.

That'll teach me to not provide a simplified testcase.

Invalid?

Comment 6

[[e-mail]]

given the silly things they try to do (paypal.co.uk trying to set cookies for paypal.com) it wouldn't surprise me. thanks for your efforts...

-> wfm