bugSamizdat - Bugs: bug #23837, BUG/FEATURE: login cookies are...

 
 

bug #23837: BUG/FEATURE: login cookies are indepedent for different site name aliases

Submitted by:  Boud Roukema <boud>
Submitted on:  Sun 13 Jul 2008 03:06:21 PM UTC  
 
Category: NoneSeverity: 2 - Minor
Status: InvalidPrivacy: Public
Assigned to: NoneOpen/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 22 Oct 2008 09:42:29 PM UTC, comment #1:

This is a standard behaviour as described in RFC 2109 "HTTP State Management Mechanism": cookie may only be returned to a server that domain-matches the Domain attribute of the cookie, and specifying a Domain that would make the cookie visible to different sites would be a severe violation of privacy and security. RFC only allows Domain attribute values that match exactly, or match any sub-domain that is exactly one level lower than the one specified, which is not nearly granular enough to protect the user.

Dmitry Borodaenko <angdraug>
Project Administrator
Sun 13 Jul 2008 03:06:21 PM UTC, original submission:

i haven't looked at this closely, so i'm just putting it here so it doesn't get forgotten about. Also, i don't know if it's a bug or a feature. :P

If you log in to a site (070818) at the url cool.samizdat.org and then in another panel/window click on http://www.cool.samizdat.org and if both of these are validated in sites.yaml and in the apache setup, then in the second case you will be considered to be not logged in. This is presumably due to the cookies.

BUG: It's a bug for people who do not realise that they have typed in an alias or got to the page via a different chain of clicks from external sites, and then are confused about whether or not they are logged in.

FEATURE: This could be useful to someone who wants to simultaneously make some publication actions anonymously, and some other publication/moderation actions under his/her login.

PRIORITY: i noticed this myself, i haven't heard about the bug/feature from other users, so it may not be a high priority to fix. On the other hand, we probably don't (yet) get enough user feedback, so lack of feedback does not mean that nobody will get upset by it.

Boud Roukema <boud>
Project Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by angdraug (Posted a comment)
  • -unavailable- added by boud (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 22 Oct 2008 09:42:29 PM UTCangdraugStatusNone=>Invalid
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1