Bugs item #1576609, was opened at 2006-10-13 11:02
Message generated for change (Comment added) made by
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=118598&aid=1576609&group_id=18598
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: HTTP Plugin
Group: None
Status: Closed
Resolution: Fixed
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Philip Aston (philipa)
Summary: "Accept Cookie" rules too strict/misplaced
Initial Comment:
There is logic in the setAttribute() method of
HTTPClient.Cookie that tests whether a cookie received
in a response has a domain that matches the domain of
the sender.
A cookie should be able to be set to a higher-level
domain than that of the sending server. i.e.: a cookie
with the domain ".domain.com" should be accepted if
sent from a site with the domain "my.site.domain.com".
This works in Grinder but ONLY IF the top-level domain
is .com, .edu, .net, .org, .gov, .mil, or .int (these
are hardcoded). For any domain that is a .ca, for
instance, this rule fails and the cookie is not allowed
to have a domain that contains less dots than the
domain of the server it was sent from.
Moreover, this seems like logic that would be better
placed in a CookiePolicyHandler. The only way I could
get my tests to work was to comment out this code and
rebuild grinder.jar.
I can be reached at bryan.cornies (at) sjrb.ca
----------------------------------------------------------------------
Comment By: Ilsa ()
Date: 2010-05-27 18:40
Message:
Correction:
I have run into a similar issue. I am trying to test a drupal-based site.
Drupal prepends a dot to the beginning of the domain portion of it's
cookies, eg:
SESSb43239df312c947f5c2c2d28e9f848e1=58a82d7f5f95ce745dae21e9513007b9;
expires=Sun, 20-Jun-2010 01:28:40 GMT; path=/; domain=.DOMAIN.TLD
When grinder recieves the cookie, I get the following error:
Bad Set-Cookie header:
SESSb43239df312c947f5c2c2d28e9f848e1=58a82d7f5f95ce745dae21e9513007b9;
expires=Sun, 20-Jun-2010 01:28:40 GMT; path=/; domain=.DOMAIN.TLD;
Current domain DOMAIN.TLD does not match given parsed .DOMAIN.TLD
The session cookie is accepted just fine by all major browsers. According
to rfc2109 and rfc 2965, the domain parameter of a cookie is supposed to
have a beginning dot, and the user agent is supposed to add one if
missing.
----------------------------------------------------------------------
Comment By: Ilsa ()
Date: 2010-05-27 18:40
Message:
I have run into a similar issue. I am trying to test a drupal-based site.
Drupal prepends a dot to the beginning of the domain portion of it's
cookies, eg:
SESSb43239df312c947f5c2c2d28e9f848e1=58a82d7f5f95ce745dae21e9513007b9;
expires=Sun, 20-Jun-2010 01:28:40 GMT; path=/; domain=.DOMAIN.TLD
When grinder recieves the cookie, I get the following error:
Bad Set-Cookie header:
SESSb43239df312c947f5c2c2d28e9f848e1=58a82d7f5f95ce745dae21e9513007b9;
expires=Sun, 20-Jun-2010 01:28:40 GMT; path=/; domain=.DOMAIN.TLD;
Current domain DOMAIN.local does not match given parsed .DOMAIN.TLD
The session cookie is accepted just fine by all major browsers. According
to rfc2109 and rfc 2965, the domain parameter of a cookie is supposed to
have a beginning dot, and the user agent is supposed to add one if missing.
----------------------------------------------------------------------
Comment By: Philip Aston (philipa)
Date: 2008-10-18 12:25
Message:
Fixed - I relaxed the rules:
http://grinder.svn.sourceforge.net/viewvc/grinder?view=rev&revision=3925
----------------------------------------------------------------------
Comment By: Philip Aston (philipa)
Date: 2008-10-18 11:25
Message:
According to RFC 2965 your cookie should not be accepted.
3.3 User Agent Role
a user agent rejects ... if any of the following is true of the
attributes explicitly present in the Set-Cookie2 response header:
..
* The effective host name that derives from the request-host does
not domain-match the Domain attribute.
* The request-host is a HDN (not IP address) and has the form HD,
where D is the value of the Domain attribute, and H is a string
that contains one or more dots.
..
Examples:
* A Set-Cookie2 from request-host y.x.foo.com for Domain=.foo.com
would be rejected, because H is y.x and contains a dot.
However, I have just done some testing with FF3, and that's quite
happy to accept your example. Roland's pithy comments in Cookie.java
about the loose interpretation of the specs are appropriate.
http://my.opera.com/yngve/blog/show.dml/267415 is also interesting.
So pragmatically, I think The Grinder should have an option to be more
liberal and I agree with you that the problem is that the algorithm is
not pluggable.
----------------------------------------------------------------------
Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-19 17:38
Message:
Logged In: NO
The following is cut out of an Ethereal trace, it is a
response back to Grinder.
Set-cookie:
JSESSIONID=131088949714C3AFD48A39038260AD79;Path=/uwc
Set-cookie:
ssogrp1-uwc=131088949714C3AFD48A39038260AD79;Domain=.shaw.ca;Path=/
The second cookie (ssogrp1-uwc) is not being accepted by
Grinder. The host that is sending these cookies is
khan.idc.shaw.ca.
----------------------------------------------------------------------
Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-19 17:33
Message:
Logged In: NO
Firefox 1.5.0.7
IE 6 and 7 beta
----------------------------------------------------------------------
Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-19 17:31
Message:
Logged In: NO
The cookie is accepted by both Firefox and IE.
----------------------------------------------------------------------
Comment By: Philip Aston (philipa)
Date: 2006-10-16 17:02
Message:
Logged In: YES
user_id=2117
Please check that the Cookie is accepted by current versions
of IE, Firefox, and perhaps Opera.
If so, please post the Cookie text.
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=118598&aid=1576609&group_id=18598
|