MSIE 7 and cookies

Collapse
This topic is closed.
X
X
 
  • Time
  • Show
Clear All
new posts
  • Ike

    #1

    MSIE 7 and cookies

    I have a username/sid pair for typical authentication. That is, for someone
    signing in under a given username, a sid is created, saved in both a cookie
    and the db on the server. This I am doing as follows:

    $timer = md5(time());
    $sid = $UserID . "+" . $timer. "+" . $country;
    SetCookie("ggco okie", $sid, time() + 86400 * 10000); //Set Cookie
    for 10000 days
    $query = "update associates set sid=\"$timer\" where
    username=\"$Use rID\"";

    Thus, when another page is called, I immediately retrieve the value of the
    cookie as follows:

    if (!(isset($ggcoo kie))) {
    echo "cookie not set in browser.";
    exit;
    }
    $sidarray = explode("+", "$ggcookie" );

    However, for one particular user I have, upon upgrading to MSIE 7, this no
    longer works as whenever he calls up a new page, he gets "cookie not set in
    browser". In looking at his security settings his Zone is "Internet," set to
    "Medium High" and his privacy policy is set to "Medium" (see below). I have
    duplicated these settings on my machine and am able to get and parse the
    cookie without any problem. I am wondering what may have changes with MSIE
    7, or something I am missing, that is throwing this entire procedure for
    this particular user? Any ideas are greatly appreciated. -Ike

    "Medium" privacy settings call for
    -blocks third party cookies that do not have a privacy policy
    -blocks third party cookies that save information that can be used to
    contact you without your explicit consent
    -restricts first-party cookies that save information that can be used to
    contact you without your explicit consent
    (note, these are the same settings as on my machine which is working fine)


  • petersprc

    #2
    Re: MSIE 7 and cookies

    Kind of weird... Is he using any kind of other firewall software?

    User could try clearing his cookies and retrying.

    You could try adding the path and domain to the cookie just to see
    what happens: setcookie('cook ie', $val, time() + $exp, '/',
    $_SERVER['HTTP_HOST']);

    On Jan 31, 7:45 pm, "Ike" <r...@hotmail.c omwrote:
    I have a username/sid pair for typical authentication. That is, for someone
    signing in under a given username, a sid is created, saved in both a cookie
    and the db on the server. This I am doing as follows:
    >
    $timer = md5(time());
    $sid = $UserID . "+" . $timer. "+" . $country;
    SetCookie("ggco okie", $sid, time() + 86400 * 10000); //Set Cookie
    for 10000 days
    $query = "update associates set sid=\"$timer\" where
    username=\"$Use rID\"";
    >
    Thus, when another page is called, I immediately retrieve the value of the
    cookie as follows:
    >
    if (!(isset($ggcoo kie))) {
    echo "cookie not set in browser.";
    exit;}
    >
    $sidarray = explode("+", "$ggcookie" );
    >
    However, for one particular user I have, upon upgrading to MSIE 7, this no
    longer works as whenever he calls up a new page, he gets "cookie not set in
    browser". In looking at his security settings his Zone is "Internet," set to
    "Medium High" and his privacy policy is set to "Medium" (see below). I have
    duplicated these settings on my machine and am able to get and parse the
    cookie without any problem. I am wondering what may have changes with MSIE
    7, or something I am missing, that is throwing this entire procedure for
    this particular user? Any ideas are greatly appreciated. -Ike
    >
    "Medium" privacy settings call for
    -blocks third party cookies that do not have a privacy policy
    -blocks third party cookies that save information that can be used to
    contact you without your explicit consent
    -restricts first-party cookies that save information that can be used to
    contact you without your explicit consent
    (note, these are the same settings as on my machine which is working fine)

    Comment

    • Curtis

      #3
      Re: MSIE 7 and cookies

      On Wed, 31 Jan 2007 16:45:35 -0800, Ike <rxv@hotmail.co mwrote:
      I have a username/sid pair for typical authentication. That is, for
      someone
      signing in under a given username, a sid is created, saved in both a
      cookie
      and the db on the server. This I am doing as follows:
      >
      $timer = md5(time());
      $sid = $UserID . "+" . $timer. "+" . $country;
      SetCookie("ggco okie", $sid, time() + 86400 * 10000); //Set Cookie
      for 10000 days
      $query = "update associates set sid=\"$timer\" where
      username=\"$Use rID\"";
      >
      Thus, when another page is called, I immediately retrieve the value of
      the
      cookie as follows:
      >
      if (!(isset($ggcoo kie))) {
      echo "cookie not set in browser.";
      exit;
      }
      $sidarray = explode("+", "$ggcookie" );
      >
      However, for one particular user I have, upon upgrading to MSIE 7, this
      no
      longer works as whenever he calls up a new page, he gets "cookie not set
      in
      browser". In looking at his security settings his Zone is "Internet,"
      set to
      "Medium High" and his privacy policy is set to "Medium" (see below). I
      have
      duplicated these settings on my machine and am able to get and parse the
      cookie without any problem. I am wondering what may have changes with
      MSIE
      7, or something I am missing, that is throwing this entire procedure for
      this particular user? Any ideas are greatly appreciated. -Ike
      >
      "Medium" privacy settings call for
      -blocks third party cookies that do not have a privacy policy
      -blocks third party cookies that save information that can be used to
      contact you without your explicit consent
      -restricts first-party cookies that save information that can be used to
      contact you without your explicit consent
      (note, these are the same settings as on my machine which is working
      fine)
      Why is it that you kill the script if the cookie isn't set? You shouldn't
      require cookies to be set in order for people to use your site.

      --
      Curtis, http://dyersweb.com

      Comment

      • Ike

        #4
        Re: MSIE 7 and cookies

        This ONLY occurs when a new browswer window is instantiated. That is, an
        instance of the browswer is running, it sets a cookie. Now, if you go to any
        page within the site, it checks to see that the cookie is set, if so, it
        let's you into the page on that site. All works fine.

        However, if you open another browswer instance (the first one, which set the
        cookie, is still running too) the second instance fails to see that the
        cookie is set in MSIE 7.

        Any ideas how I can make the second instance know that the cookie is, in
        fact, already set? Thanks, Ike


        Comment

        • Tim Roberts

          #5
          Re: MSIE 7 and cookies

          "Ike" <rxv@hotmail.co mwrote:
          >
          >This ONLY occurs when a new browswer window is instantiated. That is, an
          >instance of the browswer is running, it sets a cookie. Now, if you go to any
          >page within the site, it checks to see that the cookie is set, if so, it
          >let's you into the page on that site. All works fine.
          >
          >However, if you open another browswer instance (the first one, which set the
          >cookie, is still running too) the second instance fails to see that the
          >cookie is set in MSIE 7.
          Do your cookies have expiration dates in the future? If not, this is
          exactly how it's supposed to work. The cookies are local to the instance.
          --
          Tim Roberts, timr@probo.com
          Providenza & Boekelheide, Inc.

          Comment

          • Ike

            #6
            Re: MSIE 7 and cookies


            "Tim Roberts" <timr@probo.com wrote in message
            news:rbn5s2ddjl em73grklo6at62k krkcu946h@4ax.c om...
            "Ike" <rxv@hotmail.co mwrote:
            >>
            >
            Do your cookies have expiration dates in the future? If not, this is
            exactly how it's supposed to work. The cookies are local to the instance.
            --
            Tim Roberts, timr@probo.com
            Providenza & Boekelheide, Inc.
            Tim,

            Is this only for MSIE I suppose? In Firefox, it opens a new instance of the
            browswer, and runs fine there. -Ike


            Comment

            • Curtis

              #7
              Re: MSIE 7 and cookies

              On Fri, 02 Feb 2007 06:06:01 -0800, Ike <rxv@hotmail.co mwrote:
              >
              "Tim Roberts" <timr@probo.com wrote in message
              news:rbn5s2ddjl em73grklo6at62k krkcu946h@4ax.c om...
              >"Ike" <rxv@hotmail.co mwrote:
              >>>
              >>
              >Do your cookies have expiration dates in the future? If not, this is
              >exactly how it's supposed to work. The cookies are local to the
              >instance.
              >--
              >Tim Roberts, timr@probo.com
              >Providenza & Boekelheide, Inc.
              >
              Tim,
              >
              Is this only for MSIE I suppose? In Firefox, it opens a new instance of
              the
              browswer, and runs fine there. -Ike
              >
              >
              Try setting the expiration date ahead to see for sure

              --
              Curtis, http://dyersweb.com

              Comment

              • R. Rajesh Jeba Anbiah

                #8
                Re: MSIE 7 and cookies

                On Feb 1, 5:45 am, "Ike" <r...@hotmail.c omwrote:
                I have a username/sid pair for typical authentication. That is, for someone
                signing in under a given username, a sid is created, saved in both a cookie
                and the db on the server. This I am doing as follows:
                >
                $timer = md5(time());
                $sid = $UserID . "+" . $timer. "+" . $country;
                SetCookie("ggco okie", $sid, time() + 86400 * 10000); //Set Cookie
                for 10000 days
                <snip>

                Do not reinvent the wheels; use PHP's own session--preferrably
                with db based handler.

                --
                <?php echo 'Just another PHP saint'; ?>
                Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

                Comment

                • R. Rajesh Jeba Anbiah

                  #9
                  Re: MSIE 7 and cookies

                  On Feb 1, 9:15 am, Curtis <dyers...@veriz on.netwrote:
                  <snip>
                  Why is it that you kill the script if the cookie isn't set? You shouldn't
                  require cookies to be set in order for people to use your site.
                  Cookies are the effective way to solve many known security issues.
                  It is always better to use cookies than trans sid based sessions.

                  --
                  <?php echo 'Just another PHP saint'; ?>
                  Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

                  Comment

                  • Curtis

                    #10
                    Re: MSIE 7 and cookies

                    On Sat, 03 Feb 2007 23:19:12 -0800, R. Rajesh Jeba Anbiah
                    <ng4rrjanbiah@r ediffmail.comwr ote:
                    On Feb 1, 9:15 am, Curtis <dyers...@veriz on.netwrote:
                    <snip>
                    >Why is it that you kill the script if the cookie isn't set? You
                    >shouldn't
                    >require cookies to be set in order for people to use your site.
                    >
                    Cookies are the effective way to solve many known security issues.
                    It is always better to use cookies than trans sid based sessions.
                    >
                    --
                    <?php echo 'Just another PHP saint'; ?>
                    Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/
                    >
                    Yes, but that wasn't my point.

                    --
                    Curtis, http://dyersweb.com

                    Comment

                    Working...