php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #32827 New cookie behaviour is breaking backward compatibility
Submitted: 2005-04-25 23:03 UTC Modified: 2005-04-25 23:21 UTC
From: sesser@php.net Assigned:
Status: Closed Package: *General Issues
PHP Version: 4CVS-2005-04-25 (stable) OS: all
Private report: No CVE-ID: None
 [2005-04-25 23:03 UTC] sesser@php.net
Description:
------------
Recent changes in cookie handling breaks backward compatibility.

The netscape cookie specification says about commas in Set-Cookie header:

If there is a need to place such data in the name or value, some encoding method such as URL style %XX encoding is recommended, though no encoding is defined or required.

Read RECOMMENDED, BUT NOT REQUIRED.

Additionally this limitation only covers name=value in Set-Cookie and not Cookie name=opaque_strings.

PHP's Set-Cookie does not allow sending plain commas as Cookie, but that does not change the fact, that anyone can set a Cookie via Java Script with a plain comma in it or use another script language that runs on the same server and is part of the application. Browsers happily send them in plain back.

Lots of sites, especially those with FALK.ag ad banners have plain commas in there cookies. It is not longer possible for PHP script on those servers to handle these cookies.



Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-04-25 23:21 UTC] sniper@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Tue Nov 30 10:03:35 2021 UTC