Another IE cookie question:

trscookie · 06-14-2010, 03:40 PM

Hello all,

I am currently building a website (php) that requires cookies to be enabled, I have tested the site with multiple browsers and the only browser that will not accept php setcookie is.....you guessed it IE, I have tried various IE versions with the same result so believe that the issue could be down to a php.ini setting conflicting with IE:

Here is a copy of my php.ini from my centos 5.5 box:

Code:

[root@server trscookie]# cat /etc/php.ini | grep -v ";" | sed '/^$/d'
[PHP]
engine = On
zend.ze1_compatibility_mode = Off
short_open_tag = On
asp_tags = Off
precision    =  14
y2k_compliance = On
output_buffering = 4096
zlib.output_compression = Off
implicit_flush = Off
unserialize_callback_func=
serialize_precision = 100
allow_call_time_pass_reference = Off
safe_mode = Off
safe_mode_gid = Off
safe_mode_include_dir =
safe_mode_exec_dir =
safe_mode_allowed_env_vars = PHP_
safe_mode_protected_env_vars = LD_LIBRARY_PATH
disable_functions =
disable_classes =
expose_php = On
error_reporting  =  E_ALL
display_errors = On
display_startup_errors = Off
log_errors = On
log_errors_max_len = 1024
ignore_repeated_errors = Off
ignore_repeated_source = Off
report_memleaks = On
track_errors = Off
error_log = logs/php_error.log
variables_order = "EGPCS"
register_globals = Off
register_long_arrays = Off
register_argc_argv = Off
auto_globals_jit = On
post_max_size = 8M
magic_quotes_gpc = Off
magic_quotes_runtime = Off
magic_quotes_sybase = Off
auto_prepend_file =
auto_append_file =
default_mimetype = "text/html"
doc_root =
user_dir =
extension_dir = "/usr/lib64/php/modules"
enable_dl = On
file_uploads = On
upload_max_filesize = 2M
allow_url_fopen = On
default_socket_timeout = 60
  
[Date]
[Syslog]
define_syslog_variables  = Off
[mail function]
SMTP = localhost
smtp_port = 25
sendmail_path = /usr/sbin/sendmail -t -i
[SQL]
sql.safe_mode = Off
[ODBC]
odbc.allow_persistent = On
odbc.check_persistent = On
odbc.max_persistent = -1
odbc.max_links = -1
odbc.defaultlrl = 4096
odbc.defaultbinmode = 1
[MySQL]
mysql.allow_persistent = On
mysql.max_persistent = -1
mysql.max_links = -1
mysql.default_port =
mysql.default_socket =
mysql.default_host =
mysql.default_user =
mysql.default_password =
mysql.connect_timeout = 60
mysql.trace_mode = Off
[MySQLi]
mysqli.max_links = -1
mysqli.default_port = 3306
mysqli.default_socket =
mysqli.default_host =
mysqli.default_user =
mysqli.default_pw =
mysqli.reconnect = Off
[mSQL]
msql.allow_persistent = On
msql.max_persistent = -1
msql.max_links = -1
[PostgresSQL]
pgsql.allow_persistent = On
pgsql.auto_reset_persistent = Off
pgsql.max_persistent = -1
pgsql.max_links = -1
pgsql.ignore_notice = 0
pgsql.log_notice = 0
[Sybase]
sybase.allow_persistent = On
sybase.max_persistent = -1
sybase.max_links = -1
sybase.min_error_severity = 10
sybase.min_message_severity = 10
sybase.compatability_mode = Off
[Sybase-CT]
sybct.allow_persistent = On
sybct.max_persistent = -1
sybct.max_links = -1
sybct.min_server_severity = 10
sybct.min_client_severity = 10
[bcmath]
bcmath.scale = 0
[browscap]
[Informix]
ifx.default_host =
ifx.default_user =
ifx.default_password =
ifx.allow_persistent = On
ifx.max_persistent = -1
ifx.max_links = -1
ifx.textasvarchar = 0
ifx.byteasvarchar = 0
ifx.charasvarchar = 0
ifx.blobinfile = 0
ifx.nullformat = 0
[Session]
session.save_handler = files
session.save_path = "/tmp"
session.use_cookies = 1
session.name = PHPSESSID
session.cookie_secure = Off
session.auto_start = 0
session.cookie_lifetime = 1800
session.cookie_path = /
session.cookie_domain =
session.serialize_handler = php
session.gc_probability = 1
session.gc_divisor     = 1000
session.gc_maxlifetime = 1440
session.bug_compat_42 = 0
session.bug_compat_warn = 1
session.referer_check =
session.entropy_length = 0
session.entropy_file =
session.cache_limiter = nocache
session.cache_expire = 180
session.use_trans_sid = Off
session.hash_function = 0
session.hash_bits_per_character = 5
url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
[MSSQL]
mssql.allow_persistent = On
mssql.max_persistent = -1
mssql.max_links = -1
mssql.min_error_severity = 10
mssql.min_message_severity = 10
mssql.compatability_mode = Off
mssql.secure_connection = Off
[Assertion]
[Verisign Payflow Pro]
pfpro.defaulthost = "test-payflow.verisign.com"
pfpro.defaultport = 443
pfpro.defaulttimeout = 30
[COM]
[mbstring]
[FrontBase]
[gd]
[exif]
[Tidy]
tidy.clean_output = Off
[soap]
soap.wsdl_cache_enabled=1
soap.wsdl_cache_dir="/tmp"
soap.wsdl_cache_ttl=86400

Please, does anyone have any ideas on how to resolve this?

Many thanks,
trscookie.

rweaver · 06-14-2010, 03:47 PM

Can you post the errors and what led you to the conclusion the php.ini was responsible?

trscookie · 06-14-2010, 03:53 PM

I havent seen any errors, it just doesnt save them, I have tried on multiple computers using varying version of IE with the same result :S

tracertong · 06-15-2010, 04:25 AM

So how are you issuing the cookie? What does the PHP code around the setcookie(); directive look like? It may be something about how IE is misinterpreting what you are asking it to save. It may be doing something genius, like immediately expiring the cookie because you used 'the wrong sort of quotes', for one of the values you passed it, or something.

Browsers become more picky (and, hence, variable) if you start explicitly declaring things like Domain vs Subdomain, httponly, or unusual durations such as 'less than a minute'.

trscookie · 06-15-2010, 10:04 AM

Hello,

Thank you for the reply, currently the code is set as:

Code:

if(isset($_GET['logout']) && $_GET['logout']=='Y')
        {
        logout();
        }

if(!isset($_GET['submit_location']) && isset($_COOKIE['location']))
        {
        $location = $_COOKIE['location'];
        }
else if(isset($_GET['submit_location']) &&

else if(isset($_GET['submit_location']) &&
        isset($_GET['location']) && strlen($_GET['location'])>0)
        {
        $location = $_GET['location'];
        setcookie('location', $location, time()+COOKIE_TIME, "/tmp", 1);
        }

The define for the cookie time is stored in a 'defines' file:

Code:

DEFINE('COOKIE_TIME', '31536000');

Thanks again,
trscookie

tracertong · 06-15-2010, 11:12 AM

Well, I see your cookie's value can, potentially be a blank string. If the value argument is an empty string, or FALSE, and all other arguments match a previous call to setcookie, then the cookie will be deleted from the client.

This is internally achieved by by PHP setting the value to 'deleted' and expiration time to one year in past whenever you assign a cookie a value of ''. I don't see how you coudl arrive at this state differently, for IE browsers, but I do note this behaviour of PHP was directly intended to address the behaviour of IE web browsers which would not always delete a cookie when sent null values.

The actual comment, from the source code of the head.c module of PHP is as follows:

Code:

/*MSIE doesn't delete a cookie when you set it to a null value
* so in order to force cookies to be deleted, even on MSIE, we
* pick an expiry date 1 year and 1 second in the past */

As an aside... another Helpful Hint For Living From The Committee:

Code:

avoid domain anmes with underscores in them.

These cause IE's cookie-handling to tail-flop in a dramatic way, apparently.

trscookie · 06-15-2010, 11:28 AM

cool, thank you for your help i'll give that a shot.