Bug 322546 – [CFNetwork] Honor Expires cookie dates that use JS Date.toString() dates (month-before-day Expires values)

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Brent Fulgham]

CFNetwork's cookie-date parser rejects a cookie-date containing a parenthesized timezone comment, which is exactly the format JavaScript's Date.prototype.toString() produces. The Expires attribute is silently ignored, so a cookie the site meant to be persistent is stored as a session cookie and disappears when the browser quits.

RFC 6265 section 5.1.1 requires this to parse: "(", ")" and "-" are all delimiters, since they fall in the %x20-2F range, so the comment is consumed as a run of delimiters. "Thu Apr 10 1980 16:33:12 GMT-0700 (Pacific Daylight Time)" tokenizes to Thu / Apr / 10 / 1980 / 16:33:12 / GMT / 0700 / Pacific / Daylight / Time, and the first match for each of found-time, found-day-of-month, found-month and found-year all succeed. Chrome parses it cleanly.

Writing

    document.cookie = "session=" + token + ";expires=" + someDate + ";path=/"

with someDate from toString() rather than toUTCString() is a common pattern, so on Safari those logins silently fail to survive a restart while the same site works elsewhere.

[Radar WebKit Bug Importer]

<rdar://problem/185840799>

[Brent Fulgham]

Pull request: https://github.com/WebKit/WebKit/pull/72457

[Brent Fulgham]

Further testing revealed that the real issue was not parenthesized comments. The true issue was that CFNetwork date parsing rejects dates in "Month First" order. When these dates are used with document.cookie, the cookie expiry silently becomes a session cookie.

[EWS]

Committed 320016@main (d01d085ea0fd): <https://commits.webkit.org/320016@main>

Reviewed commits have been landed. Closing PR #72457 and removing active labels.

[Brent Fulgham]

Submitted web-platform-tests pull request: https://github.com/web-platform-tests/wpt/pull/62280