[RESOLVED] Internet Explorer Cookie Issue

zingbats

Hey guys.

function login($username, $password) {
			$query_checkuser = "SELECT * FROM users WHERE username='".$username."' AND password='".md5($password)."'";
			$query_checkuser = SlaveQuery($query_checkuser);
			if(mysql_num_rowS($query_checkuser) == 1) {
			setcookie("username", $username, time()+3600, "/", ".domain.net");
			setcookie("password", md5($password), time()+3600, "/", ".domain.net");
			return 1;
			} else {
			return 0;
			}
}

For some reason, this code fails to set cookies in Internet Explorer 7, yet it works in firefox.

I did a test php script which just created a session cookie: setcookie("name","param"); and IE managed to handle that perfectly.

Note: I've echoed out both $username and $password, and they're both not null.

bradgrafelman

Any chance you can give us a URL and sample login to this page? If you don't feel comfortable sharing this information with the world, you can PM me the link and I'll take a look at it.

zingbats

Certainly, if you go to:

http://www.photojerk.net/cookie.php?username=uname&pwl=pwl

then you'll get a page with this code:

<?
$username = $_GET['username'];
$password = $_GET['pwl'];
setcookie("username", $username, time()+3600, "/", ".photojerk.net");
setcookie("password", md5($password), time()+3600, "/", ".photojerk.net");
echo($_COOKIE['username'] . "<br>\r\n");
echo($_COOKIE['password'] . "<br>\r\n");
?>

Note: I've also allowed all cookies in IE's settings.

EDIT: I'm told that this code doesn't work in Safari either

MarkR

In some settings of MSIE, a site needs a compact P3P privacy policy in order to have its cookies accepted.

Consider adding one, even though doing so correctly is nontrivial (see p3pwiz.com)

Mark

zingbats

MarkR wrote:
In some settings of MSIE, a site needs a compact P3P privacy policy in order to have its cookies accepted.

Consider adding one, even though doing so correctly is nontrivial (see p3pwiz.com)

Mark

But surely this setting can be turned off? I mean, I have it on the lowest security / privacy settings at the moment, and it's still not working. The fact it doesn't work on Safari either suggests it's not a problem related to the privacy policy, and rather the way PHP is issuing the cookie?

MarkR

Here are some possibilities:

You are trying to set a third party cookie and the domain does not match (Solution: Don't specify the domain, or specify the correct domain)
You are setting a cookie with an expiry date which is in the past according to the client's clock (Solution: either use a session cookie, or set the expiry far enough in the future that a moderately inaccurate clock won't break it)

Normally, you should NOT specify the domain for a cookie, as this make your application more brittle and makes it harder to test (of course your dev server will have a different domain from production, right?)

You don't want dev & production to share cookies, even if they're on the same domains (they will presumably have different databases / passwords anyway)

Mark

bradgrafelman

I specify domain in cookies so that it doesn't matter if a person visits http://mydomain.com or http://www.mydomain.com as without a domain specified, the cookie will not transverse both "www" and a null domain.

In your coding example above, you have the correct format - ".domain.net" - however, was that just an example and not the actual code you're using? For example, your code should say ".photojerk.net" in the setcookie() calls. Is this correct?

EDIT: Note that your code won't work at all on the first visit, because the $_COOKIE superglobal isn't populated unless a cookie is sent from the client's browser to the server. On the first page visit, no browser has this cookie - your server sends it. On the second visit, the client sends the cookie along with the request. So, if you visit that link above, and refresh the page, you'll see the information.

zingbats

It appears that it was the time that was causing the issue. Although I couldn't fix it, I'm now going to use Javascript to set my cookies. Which seems to work a lot better

Thanks.

zingbats

bradgrafelman wrote:
I specify domain in cookies so that it doesn't matter if a person visits http://mydomain.com or http://www.mydomain.com as without a domain specified, the cookie will not transverse both "www" and a null domain.

In your coding example above, you have the correct format - ".domain.net" - however, was that just an example and not the actual code you're using? For example, your code should say ".photojerk.net" in the setcookie() calls. Is this correct?

The set cookie function is exactly the same, the only thing different is how it gets the variable, and the fact it doesn't check the database.

bradgrafelman

Actually... something's not quite right here. Your server isn't sending the correct headers. Here's how your server sends the cookie:

Set-Cookie: username=uname
Set-Cookie: password=bb199066a871d4585019e8fa6308fe6b

Now, I copied and pasted the code you posted above onto my local dev server, where the correct cookie headers were generated. Take a look:

Set-Cookie: username=uname; expires=Sun, 11 Mar 2007 18:23:56 GMT; path=/; domain=.photojerk.net
Set-Cookie: password=bb199066a871d4585019e8fa6308fe6b; expires=Sun, 11 Mar 2007 18:23:56 GMT; path=/; domain=.photojerk.net

Now as to why this is, I'm not sure... I've never run into an issue where PHP or Apache isn't sending the 'expires' or 'domain' part of the cookie when it's been explicitly set in the PHP code. I did notice, however, that you're running a rather old version of PHP - version 4.3.9 - so perhaps you should upgrade to the latest 4.4 version?

zingbats

Oh right, that was probably because I altered the cookie.php code...

It's now back to the original. Do you still get the same output?

bradgrafelman

I'm going to test it right now, but you know... there's been a DST change recently (today actually), and I'm wondering if your server wasn't patched.

EDIT: Whoa! Your server's time and date are way off. Here's the new output:

Set-Cookie: username=uname; expires=Fri, 09-Mar-2007 12:54:56 GMT; path=/; domain=.photojerk.net
Set-Cookie: password=d9729feb74992cc3482b350163a1a010; expires=Fri, 09-Mar-2007 12:54:56 GMT; path=/; domain=.photojerk.net

EDIT2: Test your server's time with code like this:

echo date('m/d/y h:i:s O T');

Let us know what it outputs.

zingbats

Interesting... It makes me wonder why the code still works with firefox

bradgrafelman

Edited my post above (see EDIT2), let us know what it says... but I'm sure that's your problem - incorrect date/time on the server.

zingbats

bradgrafelman wrote:
Edited my post above (see EDIT2), let us know what it says... but I'm sure that's your problem - incorrect date/time on the server.

http://www.photojerk.net/cookie.php now features the time and date. And your suspicions are confirmed 🙂

bradgrafelman

What's weird is that FireFox still claims that the cookies don't expire until... one hour from my local time. Very, very odd. I'm looking into that right now...

zingbats

Ok, the server admin has updated the time and it works 🙂

Thanks:

Resolved.