46514 - problems remembering forgetting log-in / log-out cookies bugzilla

Status: RESOLVED FIXED

(Core :: Networking: Cache, defect, P3)

Description

[johng]

build 2000072508 (also ture with 0724 build)

Start using bugzilla while you are logged out.  Try to view bug 45168 or other
"Netscape confidential" bug.  You get "permission denied" since you need to log
in first.  Click the log-in button, and log-in.  You get verification that you
have logged-in.  Now try to view this confidential bug 45168.  It again says
permission denied and indicates that you have not logged in.

The opposite is also true.  If, while using bugzilla, you manage to get really
logged in so you can view bugs like 45168, now try to log out.  It says you are
logged out.  Now try to view confidential bug 45168.  You can view it
immediately even though you should have gotten a "Permission denied" notice.

Comment 1

[johng]

nsbeta3 nominee since cookie problems like this could lead to privacy concerns
(you think you are logged out but you are not).

Might be similar to other cookie bug 46512.  This bug also indicates eradict
recognition of cookies.

Comment 2

[Stephen P. Morse]

This is not a cookie problem, it's a cache problem.  The cookies are indeed 
being set and deleted at the appropriate times.  But I did observe the errant 
behavior indicated.  Then I went and deleted my memory and disk cache from the 
prefs panel.  After that it worked correctly.

What is probably happening is that when you are logged out and fetch the 45168 
bug, you get the permission-denied screen which gets cached.  Then you login and 
again fetch the 45168 bug.  But instead of getting it from the server, the 
caching system intervenes and decides to send you the same page that you got 
last time for this URL, namely the permission-denied screen.  The caching system 
doesn't realize that your cookies have changed and therefore the server would 
have sent you a different response for that URL this time.

Reassigning this to caching.  You probably need to cache not just the URL, but 
also any cookies that were sent to that URL at the time that the fetch was made.

This problem doesn't occur in 4.x.  What are they doing in their caching that is 
different?

Comment 3

[gabriel]

How about this for a suggestion - when you retrieve a page from cache, check if
the cached page requests a cookie. If it does, and the creation date of the
cookie is later than the cache date of the page, reload the page from the net.

Comment 4

[Stephen P. Morse]

Cookies don't have creation dates, only expiration dates.

Comment 5

[gabriel]

Then maybe you should add a creation_timestamp field to cookies ?

Comment 6

[Stephen P. Morse]

That wouldn't be possible to do in a manner that would maintain backwards 
compatibility with existing cookie files.

Comment 7

[gabriel]

Oh well, I just posted bug 46589 anyway :-)

Comment 8

[timeless]

*** Bug 47313 has been marked as a duplicate of this bug. ***

Comment 9

[neeti]

This bug has been fixed by the fix to bug 40449.

Neeti