php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #37095 cookie returns random value
Submitted: 2006-04-16 02:14 UTC Modified: 2006-04-16 22:40 UTC
Votes:1
Avg. Score:1.0 ± 0.0
Reproduced:0 of 1 (0.0%)
From: giaym at hotmail dot com Assigned:
Status: Not a bug Package: Session related
PHP Version: 5.1.2 OS: Windows 2000
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: giaym at hotmail dot com
New email:
PHP Version: OS:

 

 [2006-04-16 02:14 UTC] giaym at hotmail dot com
Description:
------------
Randomly, the cookies send back random values to the server, values different than those set the previous page load.

I use session auto start on php.ini. PHP runs on Apache 2.

Reproduce code:
---------------
a, b, locka and lockb are cookies set with setcookie(<name>, <value>, 0, "/");

if($somevar == "lock") {
  echo "lock";
  Set cookies locka and lockb with the values of cookies a and b respectively.
} else if($somevar == "random") {
  echo "random";
  Delete locka and lockb, and give a random value to a.
} else {
  echo "none";
  if(locka not set) Set random value to a.
}
if (b not set) Set random value to b.

Enter pages in that order:
www.domain.com/page/
www.domain.com/page/lock/
www.domain.com/page/random/
www.domain.com/page/lock/

(The if logic works, this is not a case of $somevar holding an incorrect value.)

Expected result:
----------------
www.domain.com/page/
received cookies: none
output: none
sent cookies: a with value x; b with value y

www.domain.com/page/lock/
received cookies: a with value x
output: lock
sent cookies: lock a = x; lock b = y

www.domain.com/page/random/
received cookies: a with value x; b with value y; locka with value x; lockb with value y
output: random
sent cookies: delete lock a; delete lock b; a = z

www.domain.com/page/lock/
received cookies: a with value z; b with value y
output: lock
sent cookies: lock a = z; lock b = y

Actual result:
--------------
Everything as expected except the last page load: The cookie received isn't a = z, it is a = q, I mean, another value. The server then sends "lock a = q" following the logic.

PHPSESSID is received and reset on every page load.
1.
HTTP Request Headers
HTTP Request 	GET /page/ HTTP/1.1
User-Agent 	Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2

HTTP Response Headers
Set-Cookie 	PHPSESSID=3fo392aek7m274550d9oppqdo6; path=/
Expires 	Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control 	no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma 	no-cache
Set-Cookie 	a=3; path=/
Set-Cookie 	b=91-5-177-39-4-61-87-25-1-42-0-50-64-5-164-52; path=/




2. (The request is as expected)
HTTP Request Headers
HTTP Request 	GET /page/lock/ HTTP/1.1
a=3;
b=91-5-177-39-4-61-87-25-1-42-0-50-64-5-164-52

(We lock the values of a and b)
HTTP Response Headers
Set-Cookie 	locka=3; path=/
Set-Cookie 	lockb=91-5-177-39-4-61-87-25-1-42-0-50-64-5-164-52; path=/




3.(The request is as expected)
HTTP Request Headers
HTTP Request 	GET /page/random/ HTTP/1.1
Cookie
a=3;
b=91-5-177-39-4-61-87-25-1-42-0-50-64-5-164-52;
locka=3;
lockb=91-5-177-39-4-61-87-25-1-42-0-50-64-5-164-52

(We delete the locked values and set a random value for a, this case 2)
HTTP Response Headers
Set-Cookie 	locka=deleted; expires=Sat, 16-Apr-2005 01:33:24 GMT; path=/
Set-Cookie 	lockb=deleted; expires=Sat, 16-Apr-2005 01:33:24 GMT; path=/
Set-Cookie 	a=2; path=/




4. (The request is not as expected, that value for 'a' had not even been used in the whole run -we are getting 1)
HTTP Request Headers
HTTP Request 	GET /page/lock/ HTTP/1.1
a=1;
b=91-5-177-39-4-61-87-25-1-42-0-50-64-5-164-52

(We lock the received values, this case 1)
HTTP Response Headers
Set-Cookie 	locka=1; path=/
Set-Cookie 	lockb=91-5-177-39-4-61-87-25-1-42-0-50-64-5-164-52; path=/

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-04-16 02:18 UTC] giaym at hotmail dot com
Oh, same behavior for IE6. The server is located on the same machine as the browser.
 [2006-04-16 07:59 UTC] tony2001@php.net
So, your browser sends wrong data to PHP script, am I correct? Why do you report it to PHP bug system then?
 [2006-04-16 22:28 UTC] giaym at hotmail dot com
Both IE6 and Firefox? Although what you say makes sense phpinfo shows php doing the right thing. This would be a php bug only if phpinfo() was returning the wrong data, which is unlikely.
 [2006-04-16 22:30 UTC] giaym at hotmail dot com
Closing.
 [2006-04-16 22:40 UTC] tony2001@php.net
No bug -> bogus.
Feel free to reopen the report when/if you have more info.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Mon Jul 07 07:01:33 2025 UTC