Skip to content
This repository has been archived by the owner on Nov 27, 2020. It is now read-only.

Response Headers don't overwrite cookies #217

Open
gabecoyne opened this issue Dec 20, 2012 · 9 comments
Open

Response Headers don't overwrite cookies #217

gabecoyne opened this issue Dec 20, 2012 · 9 comments
Assignees
@route
Labels
bug phantomjs

Comments

@gabecoyne
Copy link

  • set initial cookie before request
    page.driver.set_cookie("user_id", 1)
  • controller sets cookies[:user_id] = 2
    visit "/change_user?user_id=2"
  • this passes - the right headers were sent back by rails app
    page.response_headers["Set-Cookie"].match("user_id=2").should_not be_nil
  • this fails, user_id cookie is still 1
    page.driver.cookies["user_id"].value.should == 2
@ghost ghost assigned route Jul 25, 2013
@route
Copy link
Contributor

route commented Aug 7, 2013

I'd like to know you opinions here guys @jonleighton @yaauie
First off this test fails:

it 'can overwrite cookies' do
  @driver.set_cookie 'capybara', 'initial'
  @session.visit('/set_cookie')

  @session.visit('/get_cookie')

  expect(@driver.body).to include('test_cookie')
end

with this:

Capybara::Poltergeist::Driver cookies support can overwrite cookies
Failure/Error: expect(@driver.body).to include('test_cookie')
expected "<html><head></head><body>initial</body></html>" to include "test_cookie"
# ./spec/integration/driver_spec.rb:474:in `block (3 levels) in <module:Poltergeist>'

Let me explain what the hell is going on here :)

For Safari:

  1. If we set cookie with domain 127.0.0.1 in response headers it will be set with the same domain
  2. If we set cookie with domain .127.0.0.1 in response headers it will be ignored

For PhantomJS

  1. If we set cookie with domain 127.0.0.1 in response headers it will be set with '.127.0.0.1' domain
  2. If we set cookie with domain .127.0.0.1 in response headers it will be set with '.127.0.0.1' domain

Every single cookie I tried to set with PhantomJS API was prepended with a dot or rejected if there was something wrong with domain name. Considering this rfc http://tools.ietf.org/html/rfc2109#section-4.3.2 PhantomJS behavior is fishy.

Further info about this concrete issue.

  1. We call page.driver.set_cookie("user_id", 1) and cookie is set for '.127.0.0.1' domain
  2. Controller sets cookies[:user_id] = 2 and cookie is set for '127.0.0.1' domain (because domain wasn't specified)
  3. PhantomJS has cookies for both domains.
  4. If we do request PhantomJS will send both cookies but on the server side we will have only one because of this https://github.com/rack/rack/blob/master/lib/rack/request.rb#L305 (Seems legit)

Thoughts?

@yaauie
Copy link
Contributor

yaauie commented Aug 7, 2013

I agree that PhantomJS behaviour looks fishy, & I'm not sure of an immediate workaround on our end. Can you submit an issue over there & reference this one?

@route
Copy link
Contributor

route commented Aug 8, 2013

I don't have thoughts about workaround either :(

@jonleighton
Copy link
Contributor

I've nothing in particular to add, I agree that this looks like a PhantomJS bug.

@route
Copy link
Contributor

route commented Aug 30, 2013

Could be webkit related stuff :( http://qt.gitorious.org/qt/qt/source/764f1a51209212b6fc60cef5c12e9748d06b57de:src/network/access/qnetworkcookie.cpp#L1000

No it's not [EDITED]

@route
Copy link
Contributor

route commented Aug 30, 2013

It appears I found the point causing this https://github.com/ariya/phantomjs/blob/master/src/qt/src/network/access/qnetworkcookiejar.cpp#L208 will try to open PR or issue and discuss the problem.

@aripollak
Copy link

Just wanted to leave a note here for anyone else trying to work around this problem - I was able to get the same functionality by setting a temporary cookie header manually. So to set a user id in a Rails signed session cookie:

def sign_in_as(user)
    session_key = Rails.configuration.session_options[:key]
    cookie_jar = ActionDispatch::Cookies::CookieJar.new(Rails.configuration.secret_token)
    cookie_jar.signed[session_key] = { value: { user_id: user.id } }
    signed_cookie = [session_key, Rack::Utils.escape(cookie_jar[session_key])].join('=')
    page.driver.add_header 'Cookie', signed_cookie, permanent: false
end

@luisico
Copy link

luisico commented May 6, 2014

Hi, stumbled up this as well. My solution was to add the cookie with javascript (using jquery-cookie in this case), which does not prepend the leading period:

page.execute_script %Q{ $.cookie('mycookie', 'true'); }

@route route mentioned this issue Jun 17, 2014
Closed
@siboulet
Copy link

ariya/phantomjs#13409

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@route route

Labels
bug phantomjs
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
8 participants
@jonleighton @twalpole @luisico @gabecoyne @yaauie @route @aripollak @siboulet