Currently, only a static cookie - assigned during initialization - is used during all POST requests. In order to allow upload-scripts to modify session variables on the fly, a true handling of Set-Cookie headers as outlined in RFC 2109 is required.
Regarding initialization, this raises one problem:
The initial cookie can not be retrieved via the document.cookie attribute anymore, because that is incomplete (it only contains the name/value pairs of the userdata, not the management information - path, expiry, domain, version). This can probably solved by introducing a new parameter.
In addition, to reflect possibly changed cookies in the browser as well, the applet should update document.cookie when the upload is finished.
Anonymous