[ grinder-Bugs-1576609 ] "Accept Cookie" rules too strict/misplaced

Bugs item #1576609, was opened at 2006-10-13 11:02
Message generated for change (Comment added) made by 
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=118598&aid=1576609&group_id=18598

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: HTTP Plugin
Group: None
Status: Closed
Resolution: Fixed
Priority: 5
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Philip Aston (philipa)
Summary: "Accept Cookie" rules too strict/misplaced

Initial Comment:
There is logic in the setAttribute() method of
HTTPClient.Cookie that tests whether a cookie received
in a response has a domain that matches the domain of
the sender.

A cookie should be able to be set to a higher-level
domain than that of the sending server.  i.e.: a cookie
with the domain ".domain.com" should be accepted if
sent from a site with the domain "my.site.domain.com".

This works in Grinder but ONLY IF the top-level domain
is .com, .edu, .net, .org, .gov, .mil, or .int (these
are hardcoded).  For any domain that is a .ca, for
instance, this rule fails and the cookie is not allowed
to have a domain that contains less dots than the
domain of the server it was sent from.

Moreover, this seems like logic that would be better
placed in a CookiePolicyHandler.  The only way I could
get my tests to work was to comment out this code and
rebuild grinder.jar.

I can be reached at bryan.cornies (at) sjrb.ca

----------------------------------------------------------------------

Comment By: Ilsa ()
Date: 2010-05-27 18:40

Message:
I have run into a similar issue.  I am trying to test a drupal-based site. 
Drupal prepends a dot to the beginning of the domain portion of it's
cookies, eg:
SESSb43239df312c947f5c2c2d28e9f848e1=58a82d7f5f95ce745dae21e9513007b9;
expires=Sun, 20-Jun-2010 01:28:40 GMT; path=/; domain=.DOMAIN.TLD

When grinder recieves the cookie, I get the following error:
Bad Set-Cookie header:
SESSb43239df312c947f5c2c2d28e9f848e1=58a82d7f5f95ce745dae21e9513007b9;
expires=Sun, 20-Jun-2010 01:28:40 GMT; path=/; domain=.DOMAIN.TLD;
       Current domain DOMAIN.local does not match given parsed .DOMAIN.TLD

The session cookie is accepted just fine by all major browsers.  According
to rfc2109 and rfc 2965, the domain parameter of a cookie is supposed to
have a beginning dot, and the user agent is supposed to add one if missing.

----------------------------------------------------------------------

Comment By: Philip Aston (philipa)
Date: 2008-10-18 12:25

Message:
Fixed - I relaxed the rules:
http://grinder.svn.sourceforge.net/viewvc/grinder?view=rev&revision=3925



----------------------------------------------------------------------

Comment By: Philip Aston (philipa)
Date: 2008-10-18 11:25

Message:

According to RFC 2965 your cookie should not be accepted.

    3.3 User Agent Role

      a user agent rejects ... if any of the following is true of the
      attributes explicitly present in the Set-Cookie2 response header:

    ..

      *  The effective host name that derives from the request-host does
         not domain-match the Domain attribute.

      *  The request-host is a HDN (not IP address) and has the form HD,
         where D is the value of the Domain attribute, and H is a string
         that contains one or more dots.

    ..

      Examples:

      *  A Set-Cookie2 from request-host y.x.foo.com for Domain=.foo.com
         would be rejected, because H is y.x and contains a dot.


However, I have just done some testing with FF3, and that's quite
happy to accept your example. Roland's pithy comments in Cookie.java
about the loose interpretation of the specs are appropriate.
http://my.opera.com/yngve/blog/show.dml/267415 is also interesting.

So pragmatically, I think The Grinder should have an option to be more
liberal and I agree with you that the problem is that the algorithm is
not pluggable.


----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-19 17:38

Message:
Logged In: NO 

The following is cut out of an Ethereal trace, it is a
response back to Grinder.

Set-cookie:
JSESSIONID=131088949714C3AFD48A39038260AD79;Path=/uwc
Set-cookie:
ssogrp1-uwc=131088949714C3AFD48A39038260AD79;Domain=.shaw.ca;Path=/

The second cookie (ssogrp1-uwc) is not being accepted by
Grinder.  The host that is sending these cookies is
khan.idc.shaw.ca.

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-19 17:33

Message:
Logged In: NO 

Firefox 1.5.0.7
IE 6 and 7 beta

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2006-10-19 17:31

Message:
Logged In: NO 

The cookie is accepted by both Firefox and IE.

----------------------------------------------------------------------

Comment By: Philip Aston (philipa)
Date: 2006-10-16 17:02

Message:
Logged In: YES 
user_id=2117

Please check that the Cookie is accepted by current versions
of IE, Firefox, and perhaps Opera.

If so, please post the Cookie text.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=118598&aid=1576609&group_id=18598

------------------------------------------------------------------------------