664959 - On cookie security issues

Status: RESOLVED INVALID

(Core :: Networking: Cookies, defect)

Description

[李瑞锋]

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Build Identifier: Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

We assume that the server time serverTime (s), the client is clientTime
Server set a cookie valid for half an hour
Then the cookie is valid for the client (Time +1800) s
Rather than (clientTime +1800) s

Reproducible: Always

Steps to Reproduce:
1.Set server time 2011-06-17 15:00:00, client time to 2011-06-17 16:00:00
2.Server (setcookie) set the cookie is valid for time (2011-06-17 15:00:00) +1800 s
The cookie expires at 2011-06-17 15:30:00
3.cookie on the client is still valid, and the client time is 2011-06-17 16:00:00

Actual Results:  
cookie on the client is still valid, and the client time is 2011-06-17 16:00:00

Expected Results:  
cookie should be expired, should be set to invalid

Comment 1

[Daniel Veditz [:dveditz]]

Your steps are unclear, could you please paste the SetCookie: header that your server is sending? Are you using Expires (which has a timezone) or max-age (number of seconds)?

Comment 2

[李瑞锋]

(In reply to comment #1)
> Your steps are unclear, could you please paste the SetCookie: header that
> your server is sending? Are you using Expires (which has a timezone) or
> max-age (number of seconds)?

My server timezone is Eight districts in East (PRC)
The header:
Server	nginx/0.7.61
Date	Thu, 23 Jun 2011 02:40:27 GMT
Content-Type	text/html
Transfer-Encoding	chunked
Connection	keep-alive
Vary	Accept-Encoding
X-Powered-By	PHP/5.2.10
Set-Cookie	test_cookie=test; expires=Thu, 23-Jun-2011 02:45:27 GMT; path=/; domain=test.com
Content-Encoding	gzip

The header:  Date	Thu, 23 Jun 2011 02:40:27 GMT
and my client time is  Thu,23 Jun 2011 10:45:27  PRC

Comment 3

[李瑞锋]

>>Comment2
sorry  my client time is Thu,23 Jun 2011 10:50:27  PRC

Comment 4

[Matthias Versen [:Matti]]

You mean that the server sets a wrong epire time ?
Note: The cookie request from the server contains an absolute time/date

I fail to see how this is a client side bug as we get an explicit time when we should expire the cookie

Comment 5

[Wayne Mery (:wsmwk)]

(In reply to Matthias Versen [:Matti] from comment #4)
> I fail to see how this is a client side bug as we get an explicit time when
> we should expire the cookie

invalid per comment 4