ginerjm Posted May 5, 2017 Share Posted May 5, 2017 (edited) For some time I have used cookies and they have worked perfectly for me. I am able to set one after a successful login and when the user clicks on my 'Sign Off' button I am able to delete the cookie by setting the expiration to something like 'time()-3600' and 'false' as my cookie value. I always use '/' as my path and my domain name for the domain. These are static. I recently began experimenting with using Chrome as my browser instead of IE and after several days with it I suddenly discovered that I cannot Sign Off my apps. I do the sign off but then can come right back in to my app without signing in again. Even more puzzling is that if I close out the Chrome session and open an IE one I then have to login. Anyone have a clue what is going on ? PS - This is all done with plain PHP, no JS Edited May 5, 2017 by ginerjm Quote Link to comment Share on other sites More sharing options...
requinix Posted May 5, 2017 Share Posted May 5, 2017 Look at your cookies in Chrome (dev tools > Application > Storage > Cookies) to see if the login cookie is still there. Also use the Network tab when signing off to see what headers your server is returning. Even more puzzling is that if I close out the Chrome session and open an IE one I then have to login.Why is that surprising? They're two different programs. It's not like they share cookies. Quote Link to comment Share on other sites More sharing options...
ginerjm Posted May 5, 2017 Author Share Posted May 5, 2017 (edited) Really? Cookies are unique to browsers? Really? Without looking at the tools yet, I can only assume that my login cookie IS still there since my security check lets me into my appl., ie, the cookie must exist. Again - all this worked great before I started experimenting with Chrome. Don't make me think that my whole security process is flawed! Ok - according to chrome://settings/cookies my login cookie is still present after my appl thinks that it has deleted it. If browsers don't share cookies, then why doesn't PHP need to perhaps handle them differently based upon the browser in use? Or is that taken care of behind the scenes? And if I am able to do this thing re: the headers, what should I be looking for? I know nothing about headers other than the ones I send from my scripts. Edited May 5, 2017 by ginerjm Quote Link to comment Share on other sites More sharing options...
NotionCommotion Posted May 5, 2017 Share Posted May 5, 2017 Yes, cookies are unique to each browser. Regarding "Even more puzzling is that if I close out the Chrome session and open an IE one I then have to login", this would be puzzling only if you were previously logged on via IE and thus that browser should already have a cookie set. Maybe you had Chrome "automatically save this password" the first time you logged on? Quote Link to comment Share on other sites More sharing options...
Jacques1 Posted May 5, 2017 Share Posted May 5, 2017 Really? Cookies are unique to browsers? Really? Cookies are unique per browser profile. A system-wide or even just browser-wide cookie storage would be awful in terms of security, privacy and isolation of different usages. Just because I have, say, the cookies for my work in one Firefox profile doesn't mean I want every single browser on the PC to send the cookies with every request. And if I am able to do this thing re: the headers, what should I be looking for? As you might have guessed: Set-Cookie Quote Link to comment Share on other sites More sharing options...
ginerjm Posted May 5, 2017 Author Share Posted May 5, 2017 Ok - I just did this In the dev tools I found the cookies listing and I deleted my login cookie. Suddenly now the appl request my password. And just as suddenly when I sign off from that same app the cookie goes away. So - why didn't that cookie go away before when I signed off? Quote Link to comment Share on other sites More sharing options...
Jacques1 Posted May 5, 2017 Share Posted May 5, 2017 Since we're neither sitting in front of your screen nor have any information, that's impossible to tell. Quote Link to comment Share on other sites More sharing options...
Psycho Posted May 5, 2017 Share Posted May 5, 2017 Really? Cookies are unique to browsers? Really? Although others answered this already, I thought I'd provide some add'l clarification. Each browser, when receiving a cookie, will store that cookie on the user's machine. That location is different per browser and by windows user (I assume oterh OSes do something similar). So, for Chrome, the cookies are stored in the following locaiton C:\Users\<your_username>\AppData\Local\Google\Chrome\User Data\Default\ This should make it perfectly clear why cookies are not shared between browsers (or users) Quote Link to comment Share on other sites More sharing options...
ginerjm Posted May 5, 2017 Author Share Posted May 5, 2017 Thank you for the further clarification. Makes it more obvious. But still doesn't answer the (now moot) question as to why my appl couldn't delete the existing cookies that apparently were imported from IE when I switched over to Chrome. Quote Link to comment Share on other sites More sharing options...
Jacques1 Posted May 5, 2017 Share Posted May 5, 2017 (edited) Again, how are we supposed to investigate this? Maybe the Set-Cookie for deletion wasn't sent. Maybe its parameters didn't match the original cookie. Maybe it's something else. If you think the problem is still there, you'll have to reproduce it and then use the browser tools to analyze the communication. // Browsers don't import cookies. This guess can be ruled out. Edited May 5, 2017 by Jacques1 Quote Link to comment Share on other sites More sharing options...
ginerjm Posted May 5, 2017 Author Share Posted May 5, 2017 I think the problem is cleared up as I said earlier. Deleting all the cookies thru the browser and then re-establishing them now lets my app delete them. Quote Link to comment Share on other sites More sharing options...
requinix Posted May 5, 2017 Share Posted May 5, 2017 It's possible you had multiple cookies. They're not unique just by name but also by parameters - a different domain or path is enough to create (or expire) a second cookie. Quote Link to comment Share on other sites More sharing options...
ginerjm Posted May 5, 2017 Author Share Posted May 5, 2017 No that wasn't it. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.