Bug #78162 [Csd]: cURL 7.64.0 does not allow to save cookies from a localserver

Edit report at https://bugs.php.net/bug.php?id=78162&edit=1 ID: 78162 Updated by: cmb@php.net Reported by: alexandre at comsoftweb dot pt Summary: cURL 7.64.0 does not allow to save cookies from a localserver Status: Closed Type: Bug Package: cURL related Operating System: Windows PHP Version: 7.3.6 Assigned To: cmb Block user comment: N Private report: N New Comment: The plan is to upgrade to curl 7.66.1 as soon as it'll be available. I'll drop a note here when that happened. Previous Comments: ------------------------------------------------------------------------ [2019-09-17 10:29:59] alexandre at comsoftweb dot pt By closing this ticket I don't know when this is fixed/don't get notified. I am waiting for this to install the latest PHP release on a project. I really need this patched ------------------------------------------------------------------------ [2019-09-16 14:59:08] cmb@php.net Since there is good progress on bug #78100, I'm closing this ticket. ------------------------------------------------------------------------ [2019-06-14 17:30:34] cmb@php.net Thanks for reporting! I can confirm this issue. However, upgrading to cURL 7.64.1 is blocked by bug #78007, upgrading to cURL 7.65.0/1 by bug #78100. Downgrading is also no option due to CVE fixes, which have been applied to the libcurl-7.64.0-3 packages. We certainly have to keep an eye on this. ------------------------------------------------------------------------ [2019-06-14 10:58:40] alexandre at comsoftweb dot pt Description: ------------ --- From manual page: https://php.net/book.curl --- > curl version is 7.64.0 > ["features"]=> int(2428829) This "features" value does not have the PSL bit set (1<<20) which means this curl version suffers from a cookie parsing bug present in 7.64.0, fixed in 7.64.1 (commit 299d9660f85), that made curl not accept cookies on domain names without any dots. Solution: upgrade (or downgrade) curl. Test script: --------------- //this url is a local server, so bluepc has no dots in this url returns cookies $url = 'http://bluepc/ERPV18/api/Shell/LoginUser/'; //Initiate cURL. $ch = curl_init($url); //thiscookie file will never have any cookies in it because bluepc has no dots curl_setopt($ch, CURLOPT_COOKIEJAR, "C:/cookies/cookieFile.txt"); curl_exec($ch); curl_close($ch); Expected result: ---------------- cookiefile should have cookies inside like this # Netscape HTTP Cookie File # https://curl.haxx.se/docs/http-cookies.html # This file was generated by libcurl! Edit at your own risk. bluepc FALSE / FALSE 0 eti_sessionInfo YgBsAHUAZQBwAGMAXABzAHEAbAAyADAAMQA3AKcAcwBpAHMAdABlAG0AYQBfAGEAbABhAGMAbwCnAEEATABBAEMATwCnAEUAeAAgADIAMAAxADkApwAxAKcAUABUAC0AUABUAA== Actual result: -------------- but it only has the header and its empty # Netscape HTTP Cookie File # https://curl.haxx.se/docs/http-cookies.html # This file was generated by libcurl! Edit at your own risk. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78162&edit=1