The LWP behaviour looks like a security problem to me.

For example, davin.ottawa.on.ca is not related to flora.ottawa.on.ca
So if one sets a cookie the other site can get it?
Very bad.

Canadian domains are in the form <organization>.<city>.<province>.ca
or <organization>.<province>.ca or <organization>.ca


John J Lee wrote:
On Fri, 20 Jun 2003, Alan Olegario wrote:
[...]

HTTP::Cookies::extract_cookies: Set cookie SMSESSION => [cookie info]
HTTP::Cookies::extract_cookies: Set cookie FORMCRED =>
HTTP::Cookies::extract_cookies: Set cookie EntFXSessionR => [cookie info]
HTTP::Cookies::extract_cookies: Set cookie LOGIN => 0

[...]


HTTP::Cookies::add_cookie_header: Checking testsite.somesite.com for cookies
HTTP::Cookies::add_cookie_header: Checking .somesite.com for cookies
HTTP::Cookies::add_cookie_header: - checking cookie path=/
HTTP::Cookies::add_cookie_header:  - checking cookie LOGIN=0
HTTP::Cookies::add_cookie_header:    it's a match
HTTP::Cookies::add_cookie_header:  - checking cookie FORMCRED=
HTTP::Cookies::add_cookie_header:    it's a match
HTTP::Cookies::add_cookie_header:  - checking cookie EntFXSessionR=[same cookie info 
as above]
HTTP::Cookies::add_cookie_header:    it's a match
HTTP::Cookies::add_cookie_header:  - checking cookie SMSESSION=[same cookie info as 
above]
HTTP::Cookies::add_cookie_header:    it's a match

[...]



Looks OK to me. LWP wants to send all your www.somesite.com cookies back to testsite.somesite.com.

Have you checked the headers that are actually being sent (eg. ethereal)?
Checking what your browser is sending and comparing with what LWP sends
will probably quickly let you find the problem.

If the Cookie header is there, standard answer: what other state are you
forgetting about (Referer, for example)?


John



-- Matthew Darwin [EMAIL PROTECTED] http://www.mdarwin.ca



Reply via email to