You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by Magnus Leuthner <ma...@googlemail.com> on 2011/01/08 08:34:48 UTC
bug report: invalid cookie format detected for IIS
Hello developers,
I've tried to use httpclient 3.x and 4.x with www.hotelextranet.com and from
what I observe it always seems to get the cookie format wrong. The cookies
end up garbled unless I specifically set the "NETSCAPE" standard. The
"BESTFIT" of 4.x doesn't seem to be the best fit for this IIS6 server. The
headers are (anonymized):
Connection: close
Date: Sat, 08 Jan 2011 07:28:19 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html; charset=utf-8
Client-Date: Sat, 08 Jan 2011 07:28:19 GMT
Client-Peer: X.X.X.X:443
Client-Response-Num: 1
Client-SSL-Cert-Issuer: /C=US/ST=UT/L=Salt Lake City/O=The USERTRUST
Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Hardware
Client-SSL-Cert-Subject:
/C=US/postalCode=98005/ST=Washington/L=Bellevue/street=3150 139th Avenue
SE/O=Expedia Inc./OU=Ecommerce Ops/OU=Issued through Expedia Inc. E-PKI
Manager/OU=Comodo PremiumSSL/CN=hotelextranet.com
Client-SSL-Cipher: RC4-MD5
Client-SSL-Warning: Peer certificate not verified
P3P: policyref="/w3c/p3p.xml", CP="CAO DSP IND COR ADM CONo CUR CUSi DEV PSA
PSD DELi OUR COM NAV PHY ONL PUR UNI"
Set-Cookie:
user=v.8,0,XXXXXXXXXXXXX$XXX$XXXXXXX$D46!G0.!5010$1C!70.$EFj$9D$2E$FBl$B9!4$FF!e02000;
Domain=.hotelextranet.com; path=/
Set-Cookie: tpid=v.1,20001; expires=Sunday, 31-Dec-2015 23:59:59 GMT;
Domain=.hotelextranet.com; path=/
Set-Cookie: MC1=GUID=XXXXXXXXXXXXXXXXXXXXX; expires=Sunday, 31-Dec-2015
23:59:59 GMT; Domain=.hotelextranet.com; path=/
Set-Cookie:
NSC_ipufmfyusbofu.dpn-443-mc=XXXXXXXXXXXXXXXXXXXXXXXXXXX;expires=Sat,
08-Jan-2011 07:38:19 GMT;path=/;secure
Without the NETSCAPE cookie format the first comma in the "user" cookie is
seen as a delimiter and the next cookie begins (name in example:
XXXXXXXXXXXXX$XXX...), which is not how it should work. Firefox gets this
right, but Arora doesn't (I suspect because of the cookie format, but I've
not investigated further). I'm not familiar with the inner workings of
httpclient but I suspect one possible solution could be to use the Server:
header to determine IIS machines of this kind and use the NETSCAPE cookie
format then?
Kind regards
Magnus
--
Please avoid sending me Word or PowerPoint attachments.
See http://www.gnu.org/philosophy/no-word-attachments.html
Re: bug report: invalid cookie format detected for IIS
Posted by Oleg Kalnichevski <ol...@apache.org>.
...
> > Netscape
> > style cookies are inherently ambiguous and there is simply no excuse to
> > continue using them, especially on the server side, especially by
> > companies like Microsoft.
>
> True, however FIrefox handles the example OK, as does Opera.
>
> So perhaps the BrowserCompatible Cookie Policy needs to be modified?
>
Just because FireFox gets this particular cookie 'right' does not mean
it will get all cookies right. Cookie values like 'a=b,c' are inherently
ambiguous and there is not much one can do about it.
Anyway, I tweaked Browser-Compatibility and Best-Match cookie policies
to emulate the behavior of Firefox more closely at a price of having to
parse all Netscape style cookies twice, and that sucks.
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: bug report: invalid cookie format detected for IIS
Posted by sebb <se...@gmail.com>.
On 9 January 2011 15:32, Oleg Kalnichevski <ol...@apache.org> wrote:
> On Sun, 2011-01-09 at 15:03 +0000, sebb wrote:
>> On 9 January 2011 11:38, Oleg Kalnichevski <ol...@apache.org> wrote:
>> > On Sat, 2011-01-08 at 08:34 +0100, Magnus Leuthner wrote:
>> >> Hello developers,
>> >>
>> >> I've tried to use httpclient 3.x and 4.x with www.hotelextranet.com and from
>> >> what I observe it always seems to get the cookie format wrong.
>> >
>> > The cookie is question violates the HTTP state management specification
>> >
>> >> The cookies
>> >> end up garbled unless I specifically set the "NETSCAPE" standard. The
>> >> "BESTFIT" of 4.x doesn't seem to be the best fit for this IIS6 server. The
>> >> headers are (anonymized):
>>
>> That's because there is no "expires" qualifier for the user cookie.
>>
>> The "expires" qualifier is unique to Netscape cookies, and is used to
>> identify them.
>>
>
> The "expires" attribute was defined as optional by the Netscape draft.
> Therefore, there can always be ambiguity as to whether or not a
> particular cookie conforms to the original draft document.
Indeed, that's what I meant
> Netscape
> style cookies are inherently ambiguous and there is simply no excuse to
> continue using them, especially on the server side, especially by
> companies like Microsoft.
True, however FIrefox handles the example OK, as does Opera.
So perhaps the BrowserCompatible Cookie Policy needs to be modified?
For example, if the Set-Cookie header has multiple elements, but only
the first has a value, and only the last has attributes, then it's
likely to be a Netscape cookie.
To be more certain, one could check all the Set-Cookie headers, and if
any have the expires attribute, then assume Netscape for all headers.
This might be harder to do, as the headers are normally processed independently.
Either or both of these could perhaps be added as an optional
behaviour (to avoid compatibility problems).
> Oleg
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: bug report: invalid cookie format detected for IIS
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Sun, 2011-01-09 at 15:03 +0000, sebb wrote:
> On 9 January 2011 11:38, Oleg Kalnichevski <ol...@apache.org> wrote:
> > On Sat, 2011-01-08 at 08:34 +0100, Magnus Leuthner wrote:
> >> Hello developers,
> >>
> >> I've tried to use httpclient 3.x and 4.x with www.hotelextranet.com and from
> >> what I observe it always seems to get the cookie format wrong.
> >
> > The cookie is question violates the HTTP state management specification
> >
> >> The cookies
> >> end up garbled unless I specifically set the "NETSCAPE" standard. The
> >> "BESTFIT" of 4.x doesn't seem to be the best fit for this IIS6 server. The
> >> headers are (anonymized):
>
> That's because there is no "expires" qualifier for the user cookie.
>
> The "expires" qualifier is unique to Netscape cookies, and is used to
> identify them.
>
The "expires" attribute was defined as optional by the Netscape draft.
Therefore, there can always be ambiguity as to whether or not a
particular cookie conforms to the original draft document. Netscape
style cookies are inherently ambiguous and there is simply no excuse to
continue using them, especially on the server side, especially by
companies like Microsoft.
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: bug report: invalid cookie format detected for IIS
Posted by sebb <se...@gmail.com>.
On 9 January 2011 11:38, Oleg Kalnichevski <ol...@apache.org> wrote:
> On Sat, 2011-01-08 at 08:34 +0100, Magnus Leuthner wrote:
>> Hello developers,
>>
>> I've tried to use httpclient 3.x and 4.x with www.hotelextranet.com and from
>> what I observe it always seems to get the cookie format wrong.
>
> The cookie is question violates the HTTP state management specification
>
>> The cookies
>> end up garbled unless I specifically set the "NETSCAPE" standard. The
>> "BESTFIT" of 4.x doesn't seem to be the best fit for this IIS6 server. The
>> headers are (anonymized):
That's because there is no "expires" qualifier for the user cookie.
The "expires" qualifier is unique to Netscape cookies, and is used to
identify them.
>>
>>
>> Connection: close
>> Date: Sat, 08 Jan 2011 07:28:19 GMT
>> Server: Microsoft-IIS/6.0
>> Content-Type: text/html; charset=utf-8
>> Client-Date: Sat, 08 Jan 2011 07:28:19 GMT
>> Client-Peer: X.X.X.X:443
>> Client-Response-Num: 1
>> Client-SSL-Cert-Issuer: /C=US/ST=UT/L=Salt Lake City/O=The USERTRUST
>> Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Hardware
>> Client-SSL-Cert-Subject:
>> /C=US/postalCode=98005/ST=Washington/L=Bellevue/street=3150 139th Avenue
>> SE/O=Expedia Inc./OU=Ecommerce Ops/OU=Issued through Expedia Inc. E-PKI
>> Manager/OU=Comodo PremiumSSL/CN=hotelextranet.com
>> Client-SSL-Cipher: RC4-MD5
>> Client-SSL-Warning: Peer certificate not verified
>> P3P: policyref="/w3c/p3p.xml", CP="CAO DSP IND COR ADM CONo CUR CUSi DEV PSA
>> PSD DELi OUR COM NAV PHY ONL PUR UNI"
>> Set-Cookie:
>> user=v.8,0,XXXXXXXXXXXXX$XXX$XXXXXXX$D46!G0.!5010$1C!70.$EFj$9D$2E$FBl$B9!4$FF!e02000;
>> Domain=.hotelextranet.com; path=/
>> Set-Cookie: tpid=v.1,20001; expires=Sunday, 31-Dec-2015 23:59:59 GMT;
>> Domain=.hotelextranet.com; path=/
>> Set-Cookie: MC1=GUID=XXXXXXXXXXXXXXXXXXXXX; expires=Sunday, 31-Dec-2015
>> 23:59:59 GMT; Domain=.hotelextranet.com; path=/
>> Set-Cookie:
>> NSC_ipufmfyusbofu.dpn-443-mc=XXXXXXXXXXXXXXXXXXXXXXXXXXX;expires=Sat,
>> 08-Jan-2011 07:38:19 GMT;path=/;secure
>>
>>
>> Without the NETSCAPE cookie format the first comma in the "user" cookie is
>> seen as a delimiter and the next cookie begins (name in example:
>> XXXXXXXXXXXXX$XXX...), which is not how it should work.
Set-Cookie headers that adhere to the RFC2109 standard may include
multiple cookies separated by commas.
So in the case of the user cookie, the header passes RFC2109, and
creates 3 cookies, two with empty values.
>
> You are wrong. Please refer to the HTTP state management spec for
> details.
>
> Oleg
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
> For additional commands, e-mail: dev-help@hc.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org
Re: bug report: invalid cookie format detected for IIS
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Sat, 2011-01-08 at 08:34 +0100, Magnus Leuthner wrote:
> Hello developers,
>
> I've tried to use httpclient 3.x and 4.x with www.hotelextranet.com and from
> what I observe it always seems to get the cookie format wrong.
The cookie is question violates the HTTP state management specification
> The cookies
> end up garbled unless I specifically set the "NETSCAPE" standard. The
> "BESTFIT" of 4.x doesn't seem to be the best fit for this IIS6 server. The
> headers are (anonymized):
>
> Connection: close
> Date: Sat, 08 Jan 2011 07:28:19 GMT
> Server: Microsoft-IIS/6.0
> Content-Type: text/html; charset=utf-8
> Client-Date: Sat, 08 Jan 2011 07:28:19 GMT
> Client-Peer: X.X.X.X:443
> Client-Response-Num: 1
> Client-SSL-Cert-Issuer: /C=US/ST=UT/L=Salt Lake City/O=The USERTRUST
> Network/OU=http://www.usertrust.com/CN=UTN-USERFirst-Hardware
> Client-SSL-Cert-Subject:
> /C=US/postalCode=98005/ST=Washington/L=Bellevue/street=3150 139th Avenue
> SE/O=Expedia Inc./OU=Ecommerce Ops/OU=Issued through Expedia Inc. E-PKI
> Manager/OU=Comodo PremiumSSL/CN=hotelextranet.com
> Client-SSL-Cipher: RC4-MD5
> Client-SSL-Warning: Peer certificate not verified
> P3P: policyref="/w3c/p3p.xml", CP="CAO DSP IND COR ADM CONo CUR CUSi DEV PSA
> PSD DELi OUR COM NAV PHY ONL PUR UNI"
> Set-Cookie:
> user=v.8,0,XXXXXXXXXXXXX$XXX$XXXXXXX$D46!G0.!5010$1C!70.$EFj$9D$2E$FBl$B9!4$FF!e02000;
> Domain=.hotelextranet.com; path=/
> Set-Cookie: tpid=v.1,20001; expires=Sunday, 31-Dec-2015 23:59:59 GMT;
> Domain=.hotelextranet.com; path=/
> Set-Cookie: MC1=GUID=XXXXXXXXXXXXXXXXXXXXX; expires=Sunday, 31-Dec-2015
> 23:59:59 GMT; Domain=.hotelextranet.com; path=/
> Set-Cookie:
> NSC_ipufmfyusbofu.dpn-443-mc=XXXXXXXXXXXXXXXXXXXXXXXXXXX;expires=Sat,
> 08-Jan-2011 07:38:19 GMT;path=/;secure
>
>
> Without the NETSCAPE cookie format the first comma in the "user" cookie is
> seen as a delimiter and the next cookie begins (name in example:
> XXXXXXXXXXXXX$XXX...), which is not how it should work.
You are wrong. Please refer to the HTTP state management spec for
details.
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org