Bug 3512 - REGRESSION (312-412): Can't log in to web mail site in Safari - www.spray.se
: REGRESSION (312-412): Can't log in to web mail site in Safari - www.spray.se
Status: RESOLVED INVALID
: WebKit
Forms
: 412
: Macintosh Mac OS X 10.4
: P1 Normal
Assigned To:
:
: InRadar, Regression
:
:
  Show dependency treegraph
 
Reported: 2005-06-13 15:17 PST by
Modified: 2010-06-17 09:00 PST (History)


Attachments
Reduced test case of site (438 bytes, text/html)
2005-06-13 15:51 PST, Chris Petersen
no flags Details


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2005-06-13 15:17:38 PST
* SUMMARY
Cant log in to mail page in Tiger www.spray.se 

* STEPS TO REPRODUCE
1. Open Safari 
2. Go to http://mail.spray.se/
3. Enter username and password and press log in

* RESULTS
Cant log in, after pressing the log in button the page only reloads. This page works fine in Panther 
Safari.
This is one of Sweden's biggest web mail sites.
------- Comment #1 From 2005-06-13 15:25:15 PST -------
5/11/05 12:43 PM Chris Petersen:
I have attached a reduced test case of the problem. The test case contain the FORM element:

<form  action="http://mail.spray.se/lsu/signin/action.jsp" method="post" name="loginbox">
<input size="" name="login" value="locqa" type="text">
<input size="" name="password" value="l0ct3st" type="password">
<input value="Logga in" type="submit">
</form>

The action and method value specified in the Form. 

5/11/05 12:51 PM Chris Petersen:
Using the attached test case with Safari 2.0 (v412) , clicking the "Logga in" submit button appears to be 
sending a request. However instead of logging into the account, the main login screen is displayed 
again. Using this test case, I can correctly log into the account under 10.4.1 (8B15) under 10.4.1 or 
Safari 1.3 (V312) under 10.3.9.
------- Comment #2 From 2005-06-13 15:27:50 PST -------
Correction:

Using this test case, I CAN'T log into the account under 10.4.1 (8B15) under 10.4.1 or 
Safari 1.3 (V312) under 10.3.9. However, the test case does work with Firefox 1.0.4.
------- Comment #3 From 2005-06-13 15:51:11 PST -------
Created an attachment (id=2306) [details]
Reduced test case of site
------- Comment #4 From 2005-06-13 15:52:11 PST -------
Apple Bug: <rdar://problem/4110617>
------- Comment #5 From 2006-01-22 04:32:50 PST -------
Adding Regression keyword.
------- Comment #6 From 2006-01-22 10:23:37 PST -------
This issue has nothing to do with WebKit.  It looks like HTTP protocol layer (in the Foundation classes?) is failing to send cookies set for "domain=.spray.se; path=/" to host "f011.mail.spray.se" during redirects that occur during the process of logging in.

This is a pretty serious omission in the behavior of cookies.  I'm surprised there haven't been more problems reported that are related to this!  (Actually, I think Geoffrey Garen *may* have hit a similar issue that he was debugging, except it was with a credit card site and the site was using SSL.  I'm copying him on this bug.)

I used ethereal to view what Safari+WebKit-r12282 (Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Safari/417.8) sent to the web site versus what Firefox 1.5 (Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8) Gecko/20051111 Firefox/1.5) sent.

Here is the first request from Safari (POSTing the login form; note some previously-set cookies are sent to mail.spray.se):

POST /lsu/signin/action.jsp HTTP/1.1
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate
Cookie: ADPROFILE=; LBC=4096df6f36c5c45311e6bd048b392ea; FS004=f9fdQd5plVP9; lsua=bG9jcWE6bG9jcWE6bG9jcWE6c2U%3D
Referer: http://bugzilla.opendarwin.org/attachment.cgi?id=2306
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Safari/417.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 28
Connection: keep-alive
Host: mail.spray.se

login=locqa&password=l0ct3st

Here is the response from the server:

HTTP/1.1 302 Found
Date: Sun, 22 Jan 2006 18:01:03 GMT
Server: Apache/1.3.31 (Unix) mod_gzip/1.3.26.1a Resin/2.1.10
Vary: Accept-Encoding
Cache-Control: private
Location: http://f011.mail.spray.se
Content-Length: 63
Set-Cookie: lsua=bG9jcWE6bG9jcWE6bG9jcWE6c2U%3D; domain=.spray.se; path=/; expires=Fri, 21-Apr-2006 23:59:59 GMT
Set-Cookie: lsub=cc950f09df3494b3a808980a98e3dd097c4ed5f41761144e354bc0f1acd5025c776899bbad5febca6a9b82af86d35f3f06efd611ae4ae280aefc7865b4c399a6474b27bf86c08939106f5266837948131874; domain=.spray.se; path=/lsu/
Set-Cookie: lsud=e9f4e810828243aed2cf0cd63c30e6b2%3A1137952863; domain=.spray.se; path=/
Set-Cookie: LBC=280632a8f2a951d44e94d7a98b33ca1; domain=.spray.se; path=/
Set-Cookie: SERVERS=f011.mail.spray.se#; domain=.spray.se; path=/
Set-Cookie: IDENTIFIANT=WXZYVXNNPYUZNLKPLQXNXWKYMSSWXXWQVLOMMOLSKWQVZYYNTUYNYOPQZLSKUUYT; domain=.spray.se; path=/
Set-Cookie: AUTH=e9f4e810828243aed2cf0cd63c30e6b2; domain=.spray.se; path=/
Set-Cookie: ADPROFILE=01970000000000000000000000000FR00000; domain=.spray.se; path=/
Set-Cookie: FS003=fSwJFiOhCXX8; path=/
Keep-Alive: timeout=1, max=25
Connection: Keep-Alive
Content-Type: text/html

The URL has moved <a href="http://f011.mail.spray.se">here</a>

Then Safari sends another request due to the 302 redirect, but only sends the one cookie where the "domain=.spray.se" was not set which is clearly incorrect:

GET / HTTP/1.1
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate
Cookie: FS011=dzcxggr5gwl9
Referer: http://bugzilla.opendarwin.org/attachment.cgi?id=2306
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Safari/417.8
Connection: keep-alive
Host: f011.mail.spray.se

In Firefox 1.5, all of the previously set cookies are sent:

GET / HTTP/1.1
Host: f011.mail.spray.se
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://bugzilla.opendarwin.org/attachment.cgi?id=2306
Cookie: LBC=4af1b401b2e3e7aac052e6085bd42ac; LBCS=aa934ead29a7dbeb513ebc63ea10f53a; SERVERS=f011.mail.spray.se#; IDENTIFIANT=WXZYVXNNPYUZNLKPLQXNXWKYMSSWXXWQVLOMMOLSKWQVZYYNTUYNYOPQZLSKUUYT; AUTH=53bf17d9cde9a8ed55a61a5b7cd91692; ADPROFILE=01970000000000000000000000000FR00000; lsud=53bf17d9cde9a8ed55a61a5b7cd91692%3A1137952954; lsua=bG9jcWE6bG9jcWE6bG9jcWE6c2U%3D; FS011=jZdBzTlHn9c_; NGUserID=d44ec856-10706-1137952064-13; NOLII=1; lea_lii=a208947a
------- Comment #7 From 2006-01-22 10:29:02 PST -------
Obviously, after the cookies aren't passed back to the web site, the web server doesn't think the user logged in and thus they are redirected back to the "original" web page, which is the behavior that's currently being seen.

Once you confirm this, please close this bug (I'd use INVALID or WONTFIX since it doesn't apply to WebKit) so it won't count against the list of WebKit regressions.
------- Comment #8 From 2006-01-22 10:42:47 PST -------
I have been informed that WebKit does handle some cookie operations, so I'll take a look at that code next!
------- Comment #9 From 2006-01-22 12:23:49 PST -------
After further review, the conclusion in Comment #6 stands.  The real bug is probably in the Foundation classes.  I'm going to attempt a horrible work-around in WebCookieAdapter.setCookies(), though, as a proof-of-concept.
------- Comment #10 From 2006-01-22 15:29:20 PST -------
I'm passing the bug on to the folks who do the NSURL Cookies internally and closing this one as INVALID since the bug is not in WebKit.
------- Comment #11 From 2006-01-25 06:26:57 PST -------
*** Bug 6728 has been marked as a duplicate of this bug. ***
------- Comment #12 From 2006-01-25 06:29:54 PST -------
(In reply to comment #6)
> In Firefox 1.5, all of the previously set cookies are sent:

Technically, all but one of the cookies (which were set in the 302 response) are sent by Firefox since one cookie had a path of "/lsu/".
------- Comment #13 From 2006-01-31 21:20:33 PST -------
Removing Regression keyword from bugs already fixed.
------- Comment #14 From 2006-02-03 13:16:49 PST -------
Added back removed keywords.
------- Comment #15 From 2006-03-12 19:58:09 PST -------
*** Bug 7738 has been marked as a duplicate of this bug. ***
------- Comment #16 From 2006-07-02 15:16:34 PST -------
*** Bug 7734 has been marked as a duplicate of this bug. ***
------- Comment #17 From 2007-02-25 09:53:46 PST -------
*** Bug 12872 has been marked as a duplicate of this bug. ***
------- Comment #18 From 2007-02-26 12:53:43 PST -------
*** Bug 12872 has been marked as a duplicate of this bug. ***
------- Comment #19 From 2007-08-14 05:26:54 PST -------
*** Bug 14962 has been marked as a duplicate of this bug. ***
------- Comment #20 From 2009-01-09 08:49:57 PST -------
*** Bug 23186 has been marked as a duplicate of this bug. ***