www-apache-bugdb mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Tim Carroll <t...@im.picker.com>
Subject mod_usertrack/2233: Incorrect writing of the date string in cookies to MSIE
Date Fri, 15 May 1998 14:07:43 GMT

>Number:         2233
>Category:       mod_usertrack
>Synopsis:       Incorrect writing of the date string in cookies to MSIE
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Fri May 15 07:10:01 PDT 1998
>Originator:     timc@im.picker.com
>Release:        1.3b6
Solaris, gcc, etc. Probably not important.
I wasn't able to get the mod_usertrack module (Apache 1.3b6) to write a dated
cookie to MSIE browsers and I discovered after looking through Microsoft docs 
that the date string sent to set a cookie must be of the form:

expires=day, dd mm yr 00:00:00 GMT

--while mod_usertrack sets the date with the string:

expires=day, dd-mm-yr 00:00:00 GMT
Attempt to set a cookie with an expiry date to MSIE. Cookie isn't accepted.
Send a cookie without an expiry date and the cookie is accepted.
(Changing the CookieExpires directive from format "2years" to 63072000 will 
not reformat the date string sent to the cookie, BTW)
The fix seems to be to change line 192 of mod_user_track.c from:

"%s%s; path=/; expires=%s, %.2d-%s-%.2d %.2d:%.2d:%.2d GMT",


"%s%s; path=/; expires=%s, %.2d %s %.2d %.2d:%.2d:%.2d GMT",

Recompilation of module code without hyphens has resulted in successfully setting
dated cookies to MSIE 3.x and 4.x on Win95 in addition to Netscape browsers.
[In order for any reply to be added to the PR database, ]
[you need to include <apbugs@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]

View raw message