[Grinder-development] [ grinder-Bugs-1576609 ] "Accept Cookie" rules too strict/misplaced

[SourceForge.net <no...@so...>]

Bugs item #1576609, was opened at 2006-10-13 08:02
Message generated for change (Comment added) made by nobody
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=118598&aid=1576609&group_id=18598

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: HTTP Plugin
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Philip Aston (philipa)
Summary: "Accept Cookie" rules too strict/misplaced

Initial Comment:
There is logic in the setAttribute() method of
HTTPClient.Cookie that tests whether a cookie received
in a response has a domain that matches the domain of
the sender.

A cookie should be able to be set to a higher-level
domain than that of the sending server.  i.e.: a cookie
with the domain ".domain.com" should be accepted if
sent from a site with the domain "my.site.domain.com".

This works in Grinder but ONLY IF the top-level domain
is .com, .edu, .net, .org, .gov, .mil, or .int (these
are hardcoded).  For any domain that is a .ca, for
instance, this rule fails and the cookie is not allowed
to have a domain that contains less dots than the
domain of the server it was sent from.

Moreover, this seems like logic that would be better
placed in a CookiePolicyHandler.  The only way I could
get my tests to work was to comment out this code and
rebuild grinder.jar.

I can be reached at bryan.cornies (at) sjrb.ca

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-20 07:33

Message:
Logged In: NO 

The following is cut out of an Ethereal trace, it is a
response back to Grinder.

Set-cookie:
JSESSIONID=131088949714C3AFD48A39038260AD79;Path=/uwc
Set-cookie:
ssogrp1-uwc=131088949714C3AFD48A39038260AD79;Domain=.shaw.ca;Path=/

The second cookie (ssogrp1-uwc) is not being accepted by
Grinder.  The host that is sending these cookies is
khan.idc.shaw.ca.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-20 07:33

Message:
Logged In: NO 

The following is cut out of an Ethereal trace, it is a
response back to Grinder.

Set-cookie:
JSESSIONID=131088949714C3AFD48A39038260AD79;Path=/uwc
Set-cookie:
ssogrp1-uwc=131088949714C3AFD48A39038260AD79;Domain=.shaw.ca;Path=/

The second cookie (ssogrp1-uwc) is not being accepted by
Grinder.  The host that is sending these cookies is
khan.idc.shaw.ca.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-20 07:33

Message:
Logged In: NO 

The following is cut out of an Ethereal trace, it is a
response back to Grinder.

Set-cookie:
JSESSIONID=131088949714C3AFD48A39038260AD79;Path=/uwc
Set-cookie:
ssogrp1-uwc=131088949714C3AFD48A39038260AD79;Domain=.shaw.ca;Path=/

The second cookie (ssogrp1-uwc) is not being accepted by
Grinder.  The host that is sending these cookies is
khan.idc.shaw.ca.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-19 14:38

Message:
Logged In: NO 

The following is cut out of an Ethereal trace, it is a
response back to Grinder.

Set-cookie:
JSESSIONID=131088949714C3AFD48A39038260AD79;Path=/uwc
Set-cookie:
ssogrp1-uwc=131088949714C3AFD48A39038260AD79;Domain=.shaw.ca;Path=/

The second cookie (ssogrp1-uwc) is not being accepted by
Grinder.  The host that is sending these cookies is
khan.idc.shaw.ca.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-19 14:33

Message:
Logged In: NO 

Firefox 1.5.0.7
IE 6 and 7 beta

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-19 14:31

Message:
Logged In: NO 

The cookie is accepted by both Firefox and IE.

----------------------------------------------------------------------

Comment By: Philip Aston (philipa)
Date: 2006-10-16 14:02

Message:
Logged In: YES 
user_id=2117

Please check that the Cookie is accepted by current versions
of IE, Firefox, and perhaps Opera.

If so, please post the Cookie text.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=118598&aid=1576609&group_id=18598