Details
-
Type:
Bug
-
Status:
Resolved
-
Priority:
Trivial
-
Resolution: Fixed
-
Affects Version/s: 1.0.1, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5, 1.9.6, 1.9.7, 1.10.0, 1.10.1
-
Fix Version/s: None
-
Component/s: Zend_Http_Client
-
Labels:None
Description
I am using Zend_Http_Client against a web application that runs on IIS 4.0. I noticed that I wasn't able to log into this application using Zend_Http_Client, but it worked fine from Firefox. I was able to narrow the cause of this problem down to the cookie getting urlencode()d where the web server/application didn't like this.
After logging in, this is the response from the server (sensitive parts are X'ed out):
HTTP/1.1 302 Object moved Server: Microsoft-IIS/4.0 Date: Tue, 14 Aug 2007 20:27:13 GMT MicrosoftOfficeWebServer: 5.0_Pub Location: XXXXXX.asp Content-Length: 131 Content-Type: text/html Set-Cookie: XXXXXX=HID=XXXXXX&UN=XXXXXXX&UID=XXXXX; path=/ Cache-control: private
In the subsequent request Zend_Http_Client sends the following:
GET /XXXXXXX/XXXXXX.asp HTTP/1.1 Host: www.XXXXXXX Accept-encoding: gzip, deflate User-agent: Zend_Http_Client Cookie: ASPSESSIONIDXXXXXXXX=XXXXXXXXXXXXXXXXXXXXX;XXXXXX=HID%3DXXXXXX%26UN%3DXXXXXXX%26UID%3DXXXXX;
Note how the cookie that was sent to us has been urlencode()d in our request. This web application apparently does not recognize this cookie and thus prevents us from logging in.
If I remove the urlencode()ing from Zend_Http_Cookie::__toString(), logging into this application works fine:
--- Zend/Http/Cookie.php (revision 1597)
+++ Zend/Http/Cookie.php (working copy)
@@ -240,7 +240,7 @@
*/
public function __toString()
{
- return $this->name . '=' . urlencode($this->value) . ';';
+ return $this->name . '=' . $this->value . ';';
}
/**
The new request will look like this:
GET /XXXXXXX/XXXXXX.asp HTTP/1.1 Host: www.XXXXXXX Accept-encoding: gzip, deflate User-agent: Zend_Http_Client Cookie: ASPSESSIONIDXXXXXXXX=XXXXXXXXXXXXXXXXXXXXX;XXXXXX=HID=XXXXXX&UN=XXXXXXX&UID=XXXXX;
By the way, this (un-urlencode()d) version is also how Firefox sends the cookie to the server.
I'm not sure if urlencode()ing is required by any RFCs dealing with cookies or whether this is simply a case where IIS or the web application in question is broken. If we need to keep urlencode() in Zend_Http_Cookie::__toString() then it'd be nice if we could specify an option to turn off urlencode()d cookies for broken web applications.
Thanks.
Attachments
Issue Links
| This issue is duplicated by: | ||||
| ZF-5407 | urlencode()d cookies too strict. |
|
|
|
Assigned to Shahar