Re: Remember Me problems with Safari and IE 7

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--===============6569040268164707381==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="------------enigEA968707FF5E602ACE8B4A55"

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigEA968707FF5E602ACE8B4A55
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Matthew,

Matthew Hixson wrote:
> HTTP/1.x 302 Moved Temporarily
> Server: Apache-Coyote/1.1
> Set-Cookie: username=3D"Une/tPQZ7PI=3D"; Version=3D1; Max-Age=3D86400
> Set-Cookie: password=3D"1CoWZYldTXlHzPRUwJQsQA=3D=3D"; Version=3D1; Max=
-=20
> Age=3D86400
> Set-Cookie: rememberme=3Dtrue; Expires=3DWed, 01-Oct-2008 21:58:40 GMT
> Set-Cookie: validation=3D241a04131269d2b88a5ca0ba9813d6a4; Expires=3DWe=
d, =20
> 01-Oct-2008 21:58:40 GMT
>
> I grabbed that with the "Live HTTP headers" plugin for Firefox.

Perfect. It's obvious that the Set-Cookie headers are different for the
cookies that persist versus those that don't. What server software are
you using, by the way?

> It looks like the username and password cookies are being given a=20
> Version=3D1 header and a Max-Age instead of Expires attribute.  My
> guess is that only Firefox knows to read the Max-Age attribute and
> turn it into the cookie's expiration time.

That's possible. The weird thing is that all those cookies are created
the same way in DefaultPersistentLoginManager.java:

Cookie usernameCookie =3D new Cookie(COOKIE_USERNAME, username);
usernameCookie.setMaxAge(60 * 60 * 24 * Integer.parseInt(cookieLife));
response.addCookie(usernameCookie);

Cookie passwdCookie =3D new Cookie(COOKIE_PASSWORD, password);
passwdCookie.setMaxAge(60 * 60 * 24 * Integer.parseInt(cookieLife));
response.addCookie(passwdCookie);

Cookie rememberCookie =3D new Cookie(COOKIE_REMEMBERME, "true");
rememberCookie.setMaxAge(60 * 60 * 24 * Integer.parseInt(cookieLife));
response.addCookie(rememberCookie);

Cookie validationCookie =3D new Cookie(COOKIE_VALIDATION, validationHash)=
;
validationCookie.setMaxAge(60 * 60 * 24 * Integer.parseInt(cookieLife));
response.addCookie(validationCookie);

I wonder if it has anything to do with the fact that the username and
password cookie values contain equals signs, due to the base64-encoding
they're being subjected to. I seem to recall some folks on the
tomcat-user mailing list saying something about that, recently.

Are you using the standard securityfilter code, or have you modified it
in any way?

-chris


--------------enigEA968707FF5E602ACE8B4A55
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkjirQMACgkQ9CaO5/Lv0PCE5wCgmdQJ1q69h5eUoS+dV/pzmpq4
tQAAn34al1GZgZfcJLHVKq9POVtjS66T
=7eae
-----END PGP SIGNATURE-----

--------------enigEA968707FF5E602ACE8B4A55--


--===============6569040268164707381==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
--===============6569040268164707381==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
securityfilter-user mailing list
securityfilter-user-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
https://lists.sourceforge.net/lists/listinfo/securityfilter-user

--===============6569040268164707381==--