Cookie Handling Issues with Konqueror?

Post by **garvinhicking** » Wed Mar 19, 2008 2:23 pm

Hi!

Ah, I forgot. The serendipity_options table is only used when the "Remember me" login feature of s9y is enabled.

Without it, no tokens are required for login.

What wonders me about Rinces Dump is that the author_information stuff gets sent when he posts a blog. Usually, this should only happen when "Remember me" is checked. So I wonder why those headers are emitted there, maybe some HTTP POst fields trigger this authentication routine.

However, rinces dump is also missing the POST serendipity_Admin.php authentication. There you should also get an author_token and other cookies!

Maybe someone can look at it before I find the time around Wednesday next week.

What would help:

1. Log out of your s9y blog
2. Remove all cookies that are associated with the URL of your s9y blog. Also truncate your serendipity_options table for all keys that do not start with "t_" in their okey column. Those are template options.
3. Restart your browser, only open your blog URL and no other tabs
4. Open LiveHTTPHeader window. Exclude all permalinks with the pattern .css, .gif, .jpg - so that only PHP actually remains.
5. Go to the admin suite of your blog, directly via serendipity_admin.php
6. After each step you now perform, check the contents of your php session file.
6. Login to your s9y blog
7. Create an entry, save the entry.
8. Save the created HTTP Header dump as well as your tracking of the PHP session file.

For Zugschlus: You might need to repeat those steps until you can reproduce your heisenbug; additionally you might want to simply add more steps of 7.) so that you have more pages to check. Also pay attention to the time you spend on the site; if it reaches your PHP session garbage routine collection, this might be an additional culprit.

Best regards,
Garvin

Zugschlus · Post by **Zugschlus** » Wed Mar 19, 2008 10:59 pm

garvinhicking wrote: 5. After each step you now perform, check the contents of your php session file.

Is it OK that _eight_ new sess_*-Files appear in /var/lib/php5 when I just call up the blog home page? Which file am I supposed to track?

garvinhicking wrote: attention to the time you spend on the site; if it reaches your PHP session garbage routine collection, this might be an additional culprit.

How can I find out which interval is used for the GC?

Greetings
Marc

Post by **garvinhicking** » Thu Mar 20, 2008 9:57 am

Hi!

Is it OK that _eight_ new sess_*-Files appear in /var/lib/php5 when I just call up the blog home page? Which file am I supposed to track?

No, that's not OK. There should be a maximum of 3 session files created with the method I described in the earlier posting.

If you get eight session files, this leaves the conclusion that each HTTP call of yourse might invoke a new session (like a call to CSS stylesheet, javascript files, external plugins etc.).

How can I find out which interval is used for the GC?

Through phpinfo(), check the session.* options and search for "gc".

Regards,
Garvin

Zugschlus · Post by **Zugschlus** » Thu Mar 20, 2008 2:53 pm

garvinhicking wrote:
Is it OK that _eight_ new sess_*-Files appear in /var/lib/php5 when I just call up the blog home page? Which file am I supposed to track?
No, that's not OK. There should be a maximum of 3 session files created with the method I described in the earlier posting.

Ok, that had something to do with the way I coaxed the browser into accessing blog.zugschlus.de in the virtual machine.

I have corrected this, am now doing this via a proxy.pac:

Code: Select all

function FindProxyForURL(url, host) {
  if( isInNet(host, "81.169.156.164", "255.255.255.255")) {
    return "PROXY 192.168.8.132:80";
  } else {
    return "DIRECT";
  }
}

and I only get a single session file now.

garvinhicking wrote:
How can I find out which interval is used for the GC?
Through phpinfo(), check the session.* options and search for "gc".

session.gc_divisor 100 100
session.gc_maxlifetime 1440 1440
session.gc_probability 0 0

24 Minutes? Or 24 Hours?

Greetings
Marc

Post by **garvinhicking** » Thu Mar 20, 2008 2:59 pm

Hi!

24 Minutes? Or 24 Hours?

24 Minutes.

Regards,
Garvin

Zugschlus · Post by **Zugschlus** » Thu Mar 20, 2008 7:32 pm

Hi,

while I haven't been awfully successful in reproducing the error in my lab setup, the followig perl code might help in keeping a watch on the PHP session directory.

Code: Select all

#!/usr/bin/perl -w

use strict;
use File::Find::Rule;
use File::stat;
use IO::File;
use English;

$OUTPUT_AUTOFLUSH=1;

my $dir="/var/lib/php5";
my %ctimes;

while(1) {
    print ".";
    foreach my $file ( File::Find::Rule->file->in("$dir") ) {
        my $sb = stat($file);
        my $out;
        if( ! defined $ctimes{$file} ) {
            $ctimes{$file}=0;
            $out="new file $file, contents:"
        } else {
            $out="$file changed since $ctimes{$file}, new contents:";
        }
        if( $sb->ctime != $ctimes{$file} ) {
            print "$out\n";
            my $fh=IO::File->new("<$file") or die("error opening $file: $!");
            print <$fh>;
            close $fh;
            print "\n";
            $ctimes{$file}=$sb->ctime;
        }
    }
    foreach my $file( keys %ctimes ) {
        if( ! stat($file) ) {
            print "$file vanished\n";
            delete $ctimes{$file};
        }
    }
    sleep(2);
}

[/code]

Post by **garvinhicking** » Fri Mar 21, 2008 11:32 am

Hi!

What about suhosin? Disabled that already?

IMHO working on this without trying to eradicate suhosin could be unnecessary work, so I'd like you to try to reproduce your heisenbug on an installation without suhosin, before we try anything more.

Regards,
Garvin

Zugschlus · Post by **Zugschlus** » Fri Mar 21, 2008 11:20 pm

garvinhicking wrote: What about suhosin? Disabled that already?

The Debian maintainers of PHP 5.2.5 have assured me that suhosin does - in the default configuration - only add more verbose logs and all "active" things are disabled by default.

garvinhicking wrote: IMHO working on this without trying to eradicate suhosin could be unnecessary work, so I'd like you to try to reproduce your heisenbug on an installation without suhosin, before we try anything more.

Since I wanted to make you happy, I have rebuilt PHP 5.2.5 on Debian stable with suhosin enabled, and all recent tests were done with that PHP version. I was able to reproduce the issue with unpatched 5.2.5 before deleting my browser cookies. Since deleting the cookies, I have not yet been able to reproduce the issue on the test system any more.

I hope that you'll accept header traces from the live system with suhosin after I have tried in the test system and saw the issue there as well, since I am very very reluctant to break the production system where I'd have to exchange the PHP for about a dozen of other PHP apps to satisfy your debugging requirements.

Greetings
Marc

Post by **garvinhicking** » Sat Mar 22, 2008 12:36 pm

I hope that you'll accept header traces from the live system with suhosin after I have tried in the test system and saw the issue there as well, since I am very very reluctant to break the production system where I'd have to exchange the PHP for about a dozen of other PHP apps to satisfy your debugging requirements.

The other PHP applications are usual ones, that do not mangle with PHP session files in a special manor? If any of them might access the session storage path on their own, they could be responsible for interferance?

Squirrelmail is one of the applications that mangle with my PHP session files on my test server...

Regards,
Garvin

Zugschlus · Post by **Zugschlus** » Sat Mar 22, 2008 2:35 pm

garvinhicking wrote:
I hope that you'll accept header traces from the live system with suhosin after I have tried in the test system and saw the issue there as well, since I am very very reluctant to break the production system where I'd have to exchange the PHP for about a dozen of other PHP apps to satisfy your debugging requirements.
The other PHP applications are usual ones, that do not mangle with PHP session files in a special manor? If any of them might access the session storage path on their own, they could be responsible for interferance?

Squirrelmail is one of the applications that mangle with my PHP session files on my test server...

I am not sure what is installed there since I am not the only user on that box, but I am at least aware of a couple of other s9y installations, gallery, gallery2, pickle, phpmyadmin and dokuwiki.

Greetings
Marc

Zugschlus · Post by **Zugschlus** » Sun Mar 23, 2008 2:29 am

Hi,

I have found one more specialty of the system in question: All PHP applications running on the box have their own apache instance, all using mod-php, and are running under different UIDs. However, the php instances are all writing their session files to the default directory /var/lib/php5.

I don't know how php builds the session file names, but can this be a source of conflict here? For the time being, I have told the php that runs my blog's php stuff to write its session files somewhere else. I'll report back whether my problem still comes up.

Greetings
Marc

Zugschlus · Post by **Zugschlus** » Sun Mar 23, 2008 9:33 am

Zugschlus wrote: I have found one more specialty of the system in question: All PHP applications running on the box have their own apache instance, all using mod-php, and are running under different UIDs. However, the php instances are all writing their session files to the default directory /var/lib/php5.

I don't know how php builds the session file names, but can this be a source of conflict here? For the time being, I have told the php that runs my blog's php stuff to write its session files somewhere else. I'll report back whether my problem still comes up.

It still comes up, so a potential conflict in php session file names is ruled out as well.

Greetings
Marc

Zugschlus · Post by **Zugschlus** » Sun Mar 23, 2008 9:44 am

Hi,

finally, I have session data _and_ live headers. Here is what I did:

- delete blog.zugschlus.de cookies
- close firefox
- open firefox
- verify that s9y_option has 0 rows
- verify that blog.zugschlus.de cookies are still gone
- start live headers
- start watchsession
-1- call up blog
-2- call serendipity_admin
-3- log in
-4- click "comments"
=> login screen

This is the output of watchsession; the numbers written right into the watchsession dump show when I did the corresponding thing listed above

Code: Select all

1
.

...new file /home/mh-blog-zugschlus-de/apache/var/lib/php5/sess_f2f84bd24f36d30dd8bc180be7292515, contents:
SERVER_GENERATED_SID|b:1;serendipityLanguage|s:2:"en";serendipityAuthedUser|b:0;HTTP_REFERER|s:36:"http://del.icio.us/Zugschlus/frequse";no_smarty|N;
new file /home/mh-blog-zugschlus-de/apache/var/lib/php5/sess_537596a1adf4942183aa919aeeff636d, contents:
SERVER_GENERATED_SID|b:1;serendipityLanguage|s:2:"en";serendipityAuthedUser|b:0;
./home/mh-blog-zugschlus-de/apache/var/lib/php5/sess_f2f84bd24f36d30dd8bc180be7292515 changed since 1206260108, new contents:
SERVER_GENERATED_SID|b:1;serendipityLanguage|s:2:"en";serendipityAuthedUser|b:0;HTTP_REFERER|s:36:"http://del.icio.us/Zugschlus/frequse";no_smarty|N;
./home/mh-blog-zugschlus-de/apache/var/lib/php5/sess_f2f84bd24f36d30dd8bc180be7292515 changed since 1206260109, new contents:
SERVER_GENERATED_SID|b:1;serendipityLanguage|s:2:"en";serendipityAuthedUser|b:0;HTTP_REFERER|s:36:"http://del.icio.us/Zugschlus/frequse";no_smarty|N;
new file /home/mh-blog-zugschlus-de/apache/var/lib/php5/sess_d1229847bf062b9bffc0c3518ce925de, contents:
SERVER_GENERATED_SID|b:1;serendipityLanguage|s:2:"en";serendipityAuthedUser|b:0;
..

.2


../home/mh-blog-zugschlus-de/apache/var/lib/php5/sess_f2f84bd24f36d30dd8bc180be7292515 changed since 1206260113, new contents:
SERVER_GENERATED_SID|b:1;no_smarty|N;
.


3


../home/mh-blog-zugschlus-de/apache/var/lib/php5/sess_f2f84bd24f36d30dd8bc180be7292515 changed since 1206260123, new contents:
SERVER_GENERATED_SID|b:1;no_smarty|N;serendipityLanguage|s:2:"en";author_token|s:40:"be6d0917ce9d4a16e00d56a12eee28bf6a3f858d";serendipityUser|s:9:"Zugschlus";serendipityRealname|s:22:"Marc 'Zugschlus' Haber";serendipityPassword|s:32:"0dd791594955afc2cff36b72221dda76";serendipityEmail|s:33:"mh+blog-zugschlus-de@zugschlus.de";serendipityAuthorid|s:1:"2";serendipityUserlevel|s:3:"255";serendipityAuthedUser|b:1;serendipityRightPublish|s:1:"1";
..

4


.../home/mh-blog-zugschlus-de/apache/var/lib/php5/sess_f2f84bd24f36d30dd8bc180be7292515 changed since 1206260131, new contents:
SERVER_GENERATED_SID|b:1;no_smarty|N;
...

The watchsession stuff is cluttered by things generated by other blog users, but I tried using a packet filter to only allow connects from my own client during the test and it was considerably harder to see the issue then.

And here are the live headers:

Code: Select all

$ cat headers-2
http://blog.zugschlus.de/

GET / HTTP/1.1
Host: blog.zugschlus.de
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080129 Iceweasel/2.0.0.12 (Debian-2.0.0.12-2)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://del.icio.us/Zugschlus/frequse

HTTP/1.x 200 OK
Date: Sun, 23 Mar 2008 08:15:07 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: 0
Cache-Control: no-cache, pre-check=0, post-check=0
Pragma: no-cache
X-Session2-Reinit: true
X-Blog: Serendipity
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Set-Cookie: PHPSESSID=f2f84bd24f36d30dd8bc180be7292515; path=/
Set-Cookie: serendipity[markread_visitor]=a720393fa37a3159c7953588dd55139353f3e366ff3595e9cf83f0f7de784638; expires=Tue, 22-Apr-2008 08:15:07 GMT; path=/; domain=blog.zugschlus.de
Via: 1.1 blog.zugschlus.de
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
----------------------------------------------------------
http://www.gravatar.com/avatar.php?default=&gravatar_id=38ee932da617d118cd0ee96318b5a648&size=40&border=&rating=R

GET /avatar.php?default=&gravatar_id=38ee932da617d118cd0ee96318b5a648&size=40&border=&rating=R HTTP/1.1
Host: www.gravatar.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080129 Iceweasel/2.0.0.12 (Debian-2.0.0.12-2)
Accept: image/png,*/*;q=0.5
Accept-Language: de,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.zugschlus.de/
Cookie: serendipity[markread_visitor]=ce5ba480064b82236c208f42239314a42188802fc1d8aa262b6dab638b7ba41d
If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT

HTTP/1.x 200 OK
Server: nginx/0.6.26
Date: Sun, 23 Mar 2008 08:15:10 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
Expires: Sun, 23 Mar 2008 09:01:44 GMT
Content-Length: 0
X-Varnish: 1540983742 1540770384
Age: 335
Via: 1.1 varnish
----------------------------------------------------------
http://www.gravatar.com/avatar.php?default=&gravatar_id=2f971ab88115bfbb097734fb0e7e2546&size=40&border=&rating=R

GET /avatar.php?default=&gravatar_id=2f971ab88115bfbb097734fb0e7e2546&size=40&border=&rating=R HTTP/1.1
Host: www.gravatar.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080129 Iceweasel/2.0.0.12 (Debian-2.0.0.12-2)
Accept: image/png,*/*;q=0.5
Accept-Language: de,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.zugschlus.de/
Cookie: serendipity[markread_visitor]=ce5ba480064b82236c208f42239314a42188802fc1d8aa262b6dab638b7ba41d
If-Modified-Since: Thu, 01 Jan 1970 00:00:00 GMT

HTTP/1.x 200 OK
Server: nginx/0.6.26
Date: Sun, 23 Mar 2008 08:15:10 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Last-Modified: Thu, 01 Jan 1970 00:00:00 GMT
Expires: Sun, 23 Mar 2008 08:21:30 GMT
Content-Length: 0
X-Varnish: 1091228757 1090286474
Age: 1468
Via: 1.1 varnish
----------------------------------------------------------
http://blog.zugschlus.de/archives/P2.html

GET /archives/P2.html HTTP/1.1
Host: blog.zugschlus.de
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080129 Iceweasel/2.0.0.12 (Debian-2.0.0.12-2)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.zugschlus.de/
X-Moz: prefetch
Cookie: PHPSESSID=f2f84bd24f36d30dd8bc180be7292515; serendipity[markread_visitor]=a720393fa37a3159c7953588dd55139353f3e366ff3595e9cf83f0f7de784638

HTTP/1.x 200 OK
Date: Sun, 23 Mar 2008 08:15:12 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: 0
Cache-Control: no-cache, pre-check=0, post-check=0
Pragma: no-cache
X-Blog: Serendipity
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Via: 1.1 blog.zugschlus.de
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
----------------------------------------------------------
http://blog.zugschlus.de/admin

GET /admin HTTP/1.1
Host: blog.zugschlus.de
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080129 Iceweasel/2.0.0.12 (Debian-2.0.0.12-2)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.zugschlus.de/
Cookie: PHPSESSID=f2f84bd24f36d30dd8bc180be7292515; serendipity[markread_visitor]=a720393fa37a3159c7953588dd55139353f3e366ff3595e9cf83f0f7de784638

HTTP/1.x 302 Found
Date: Sun, 23 Mar 2008 08:15:22 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: 0
Cache-Control: no-cache, pre-check=0, post-check=0
Pragma: no-cache
X-Blog: Serendipity
Location: http://blog.zugschlus.de/serendipity_admin.php
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Via: 1.1 blog.zugschlus.de
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
----------------------------------------------------------
http://blog.zugschlus.de/serendipity_admin.php

GET /serendipity_admin.php HTTP/1.1
Host: blog.zugschlus.de
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080129 Iceweasel/2.0.0.12 (Debian-2.0.0.12-2)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.zugschlus.de/
Cookie: PHPSESSID=f2f84bd24f36d30dd8bc180be7292515; serendipity[markread_visitor]=a720393fa37a3159c7953588dd55139353f3e366ff3595e9cf83f0f7de784638

HTTP/1.x 200 OK
Date: Sun, 23 Mar 2008 08:15:23 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 4162
Content-Type: text/html; charset=UTF-8
Via: 1.1 blog.zugschlus.de
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
----------------------------------------------------------
http://blog.zugschlus.de/serendipity_admin.php

POST /serendipity_admin.php HTTP/1.1
Host: blog.zugschlus.de
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080129 Iceweasel/2.0.0.12 (Debian-2.0.0.12-2)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.zugschlus.de/serendipity_admin.php
Cookie: PHPSESSID=f2f84bd24f36d30dd8bc180be7292515; serendipity[markread_visitor]=a720393fa37a3159c7953588dd55139353f3e366ff3595e9cf83f0f7de784638
Content-Type: application/x-www-form-urlencoded
Content-Length: 113
serendipity%5Baction%5D=admin&serendipity%5Buser%5D=Zugschlus&serendipity%5Bpass%5D=<snip>&submit=Login+%3E
HTTP/1.x 200 OK
Date: Sun, 23 Mar 2008 08:15:31 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Serendipity-InterfaceLangSource: Database
X-Serendipity-InterfaceLang: en
Content-Type: text/html; charset=UTF-8
Set-Cookie: serendipity[old_session]=f2f84bd24f36d30dd8bc180be7292515; expires=Tue, 22-Apr-2008 08:15:31 GMT; path=/; domain=127.0.0.1:1312
Set-Cookie: serendipity[author_token]=be6d0917ce9d4a16e00d56a12eee28bf6a3f858d; expires=Tue, 22-Apr-2008 08:15:31 GMT; path=/; domain=127.0.0.1
Set-Cookie: serendipity[userDefLang]=en; expires=Tue, 22-Apr-2008 08:15:31 GMT; path=/; domain=127.0.0.1:1312
Set-Cookie: serendipity[author_information]=deleted; expires=Sat, 24-Mar-2007 08:15:30 GMT; path=/; domain=127.0.0.1
Set-Cookie: serendipity[author_information_iv]=deleted; expires=Sat, 24-Mar-2007 08:15:30 GMT; path=/; domain=127.0.0.1
Set-Cookie: serendipity[old_session]=f2f84bd24f36d30dd8bc180be7292515; expires=Tue, 22-Apr-2008 08:15:31 GMT; path=/; domain=127.0.0.1:1312
Set-Cookie: serendipity[userDefLang]=en; expires=Tue, 22-Apr-2008 08:15:31 GMT; path=/; domain=127.0.0.1:1312
Via: 1.1 blog.zugschlus.de
Keep-Alive: timeout=15, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
----------------------------------------------------------
http://blog.zugschlus.de/serendipity_admin.php?serendipity[adminModule]=comments

GET /serendipity_admin.php?serendipity[adminModule]=comments HTTP/1.1
Host: blog.zugschlus.de
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080129 Iceweasel/2.0.0.12 (Debian-2.0.0.12-2)
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://blog.zugschlus.de/serendipity_admin.php
Cookie: PHPSESSID=f2f84bd24f36d30dd8bc180be7292515; serendipity[markread_visitor]=a720393fa37a3159c7953588dd55139353f3e366ff3595e9cf83f0f7de784638

HTTP/1.x 200 OK
Date: Sun, 23 Mar 2008 08:15:41 GMT
Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch10
X-Powered-By: PHP/5.2.0-8+etch10
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Serendipity-InterfaceLangSource: Database
X-Serendipity-InterfaceLang: en
Content-Length: 4162
Content-Type: text/html; charset=UTF-8
Set-Cookie: serendipity[old_session]=f2f84bd24f36d30dd8bc180be7292515; expires=Tue, 22-Apr-2008 08:15:42 GMT; path=/; domain=127.0.0.1:1312
Set-Cookie: serendipity[userDefLang]=en; expires=Tue, 22-Apr-2008 08:15:42 GMT; path=/; domain=127.0.0.1:1312
Via: 1.1 blog.zugschlus.de
Keep-Alive: timeout=15, max=97
Connection: Keep-Alive
----------------------------------------------------------

(Password was changed, all session files deleted before posting this; I hope that I didn't open any holes to the live system by posting this).

Does this output help?

Greetings
Marc

Post by **garvinhicking** » Mon Mar 24, 2008 9:20 pm

Hi!

Here's your problem:

Code: Select all

Set-Cookie: serendipity[old_session]=f2f84bd24f36d30dd8bc180be7292515; expires=Tue, 22-Apr-2008 08:15:31 GMT; path=/; domain=127.0.0.1:1312

Your server sets a cookie for 127.0.0.1:1312 domain, but your browser rejects this cookie.

I think this is caused by a reverse proxy you are using?

Regards,
Garvin

Zugschlus · Post by **Zugschlus** » Mon Mar 24, 2008 9:43 pm

garvinhicking wrote:Hi!
Here's your problem:
Code: Select all
Set-Cookie: serendipity[old_session]=f2f84bd24f36d30dd8bc180be7292515; expires=Tue, 22-Apr-2008 08:15:31 GMT; path=/; domain=127.0.0.1:1312
Your server sets a cookie for 127.0.0.1:1312 domain, but your browser rejects this cookie.

I think this is caused by a reverse proxy you are using?

Thanks for spotting this. Looks like the reverse proxy is acting up as I see the cookie's domain rewritten in earlier requests. I'll do a trace on the circuit between reverse proxy and application.

Greetings
Marc

Cookie Handling Issues with Konqueror?

perl code to watch PHP session directory

Re: perl code to watch PHP session directory

Re: perl code to watch PHP session directory

Re: perl code to watch PHP session directory

Re: perl code to watch PHP session directory

Nailed it!

Re: Nailed it!

Re: Nailed it!