note 61456 deleted from features.cookies by betz

Note Submitter: davidpesta at gmail at nospam dot com Reason: useless ---- I encountered a problem with the whole cookie-session database arrangement with the changing cookie-session signatures. Changing session signatures won't work if you are invoking a popup for a feature in your application. (And perhaps other things as well that I have not been able to investigate.) For most users everything works fine, but my logs show that a few users are hitting the popup page TWICE whenever they try to invoke the popup--once by their service provider or browser or some other unknown thing, and the second time is their actual arrival to the popup page. From what I could tell so far, this seems to have been experienced only by AOL users. AOL and perhaps others seem to perform some kind of 'initial review' of the application's popup before sending the user's browser there--even if they don't use the AOL client and are using IE6. This 'initial review' triggers the code that changes the session signature, but does not update the cookie in the client. When the user is sent to the popup, the signature is no longer valid and they are logged out. AOL might be doing this as a part of their popup blocking technology to distinguish between the undesirable spam popups and the purposeful application popups. If that is so, they are unwittingly sabotaging a perfectly good way to keep user sessions secure. To make a very long story short, when I removed the whole process that changes the cookie-session signature and when I just keep the cookie signature a constant, the problem goes away and the user is able to use everything perfectly. In this case, the cookie-session signature remains constant, so the 'initial review' doesn't change anything when it performs its run-through. When the user is finally sent to the page, the signature is still valid. It will be interesting to see what other people have experienced with this issue. A possible solution/workaround to this problem would be to continue changing the signature between same-page navigations, but NOT perform the signature change inside of popups.