Subject: [http-state] path0014

From: Adam Barth <[email-masked]>
Date: Fri, 21 Aug 2009 10:58:15 -0700

The handling of the Path attribute looks pretty broadly interoperable
among the major browsers.  Below is one exception, path0014:

Set-Cookie: foo=bar; path=/cookie-parser-result/foo/qux/
Location: /cookie-parser-result/foo/qux?path0014

Basically, what this is testing is whether you can access a
Path-restricted cookie if your path is missing the last "/" in the
Path attribute's value.  Here's how browser behave:

Do not send cookie:
* Internet Explorer
* Safari
* Chrome
* Opera

Do send cookie:
* Firefox

The current draft uses the IE/Safari/Chrome/Opera behavior.

dwitte, do you know if there's a specific reason Firefox behaves like this?

Adam

---

From: Daniel Veditz <[email-masked]>
Date: Fri, 28 Aug 2009 09:15:13 -0700

Firefox isn't just ignoring a missing '/', it specifically allows for
four specific path-ending delimiters and '?' is one of them. This is
apparently because Citibank's site was breaking at one point.

http://mxr.mozilla.org/mozilla/source/netwerk/cookie/src/nsCookieService.cpp#1198
https://bugzilla.mozilla.org/show_bug.cgi?id=156725

---

From: Adam Barth <[email-masked]>
Date: Fri, 28 Aug 2009 09:36:43 -0700

Thanks.  This is very helpful.  I'll add the other cases to the test suite.

It's too bad no one answered Question #1 in
<https://bugzilla.mozilla.org/show_bug.cgi?id=156725#c38>:

"Question 1: Why doesn't this break with other browsers like IE?"

Adam

---

From: "Anne van Kesteren" <[email-masked]>
Date: Fri, 28 Aug 2009 19:09:35 +0200

> "Question 1: Why doesn't this break with other browsers like IE?"

Because Mozilla implemented a different policy for setting policy cookies  
just before this bug happened. (That's why e.g. Arun refers to it as a  
regression I suppose.) Linked from that bug is this bug about that policy:

   https://bugzilla.mozilla.org/show_bug.cgi?id=155083

However, if that was the cause the fix for Citibank could've been checked  
out again and that has not happened... Maybe an oversight?

-- 
Anne van Kesteren
http://annevankesteren.nl/

---

From: Adam Barth <[email-masked]>
Date: Fri, 28 Aug 2009 10:25:50 -0700

> out again and that has not happened... Maybe an oversight?

I see.  They tried not letting path /foo set a cookie for path /bar as
required by 2109.  Yeah, that doesn't work at all.

The deviation in path0014 is actually coming from this code a bit earlier:

http://mxr.mozilla.org/mozilla/source/netwerk/cookie/src/nsCookieService.cpp#1187

where they ignore any trailing / in the cookie path.  I'll have to
look back in time via blame to see where this stanza comes from.

Adam

---

From: Daniel Witte <[email-masked]>
Date: Fri, 28 Aug 2009 11:20:53 -0700

> look back in time via blame to see where this stanza comes from.

Well... that's just setting things up for the check directly after,
where we make sure the trailing character in question is one of '/',
'?', '#', or ';'.

Since this behavior was changed to its current state a long time ago
(as most things, with cookies), it's going to be hard to figure out
what relevance it has now. In the cases where a majority of the other
browsers differ from our behavior, and it makes sense to do so, I'm
certainly willing to make changes to our implementation to bring it in
line.

Dan

---

From: Daniel Veditz <[email-masked]>
Date: Fri, 28 Aug 2009 15:26:51 -0700

> certainly willing to make changes to our implementation to bring it in

Me too. My response wasn't an attempt to defend current behavior, just
adding what I could find about the "why". In particular adding "#" and
";" as delimiters wasn't solving any known problem other than it seemed
like a good idea at the time.