Re: Remember Me problems with Safari and IE 7

On Sep 30, 2008, at 3:49 PM, Christopher Schultz wrote:

> Matthew,
>
> Matthew Hixson wrote:
>> HTTP/1.x 302 Moved Temporarily
>> Server: Apache-Coyote/1.1
>> Set-Cookie: username="Une/tPQZ7PI="; Version=1; Max-Age=86400
>> Set-Cookie: password="1CoWZYldTXlHzPRUwJQsQA=="; Version=1; Max-
>> Age=86400
>> Set-Cookie: rememberme=true; Expires=Wed, 01-Oct-2008 21:58:40 GMT
>> Set-Cookie: validation=241a04131269d2b88a5ca0ba9813d6a4; Expires=Wed,
>> 01-Oct-2008 21:58:40 GMT
>>
>> I grabbed that with the "Live HTTP headers" plugin for Firefox.
>
> Perfect. It's obvious that the Set-Cookie headers are different for  
> the
> cookies that persist versus those that don't. What server software are
> you using, by the way?
>
>> It looks like the username and password cookies are being given a
>> Version=1 header and a Max-Age instead of Expires attribute.  My
>> guess is that only Firefox knows to read the Max-Age attribute and
>> turn it into the cookie's expiration time.
>
> That's possible. The weird thing is that all those cookies are created
> the same way in DefaultPersistentLoginManager.java:
>
> Cookie usernameCookie = new Cookie(COOKIE_USERNAME, username);
> usernameCookie.setMaxAge(60 * 60 * 24 * Integer.parseInt(cookieLife));
> response.addCookie(usernameCookie);
>
> Cookie passwdCookie = new Cookie(COOKIE_PASSWORD, password);
> passwdCookie.setMaxAge(60 * 60 * 24 * Integer.parseInt(cookieLife));
> response.addCookie(passwdCookie);
>
> Cookie rememberCookie = new Cookie(COOKIE_REMEMBERME, "true");
> rememberCookie.setMaxAge(60 * 60 * 24 * Integer.parseInt(cookieLife));
> response.addCookie(rememberCookie);
>
> Cookie validationCookie = new Cookie(COOKIE_VALIDATION,  
> validationHash);
> validationCookie.setMaxAge(60 * 60 * 24 *  
> Integer.parseInt(cookieLife));
> response.addCookie(validationCookie);
>
> I wonder if it has anything to do with the fact that the username and
> password cookie values contain equals signs, due to the base64- 
> encoding
> they're being subjected to. I seem to recall some folks on the
> tomcat-user mailing list saying something about that, recently.
>
> Are you using the standard securityfilter code, or have you modified  
> it
> in any way?
>
> -chris

I think this does have something to do with Tomcat.  I'm using version  
6.0.18.  And I have not modified securityfilter source.
   -M@


-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/