note 62549 added to function.setcookie

I've just been fighting with an issue with setting cookie paths that contain the underscore [_] and dash [-] characters on IIS6. This issue is a known "feature" that was added to IIS6 to help prevent cross-site scripting vunerabilities (See: http://tinyurl.com/n5hq9). Basically, when IIS6 is asked to go to a URI that doesn't contain a trailing slash, it will "courtesy redirect" to the URI with a trailing slash, but in doing so will encode underscores and dashes into their ASCII codes (%5F and %2D respectively). Now, while this normally wouldn't be an issue, when a cookie is set by PHP using a defined path the unencoded version is used for the path. PHP does not know that the path is encoded, as IIS6 decodes it before it's given to the script (I assume). Example: URI = http://somedomain.com/some_directory IIS redirects = http://somedomain.com/some%5Fdirectory/ PHP sees: http://somedomain.com/some_directory/ PHP_SELF: /some_directory/script.php So, setting the path: path="/some_directory/" but browser sees: path="/some%5Fdirectory/" which are not equal, so therefore the paths aren't the same and the cookie isn't retrieved. Normally this wouldn't be an issue: simply don't specify a path & the browser handles it for you; or don't use underscores or dashes in the URI; or specify the URI with the trailing slash. But when used to lock down sessions to a specific directory (which might have those characters) this becomes a big problem (default session path is /). The solution is to also set a cookie using the session information (name, value & other parameters) for the encoded version of the path, then the same session will be used for either version of the path. Cameron. ---- Server IP: 210.55.230.123 (proxied: 202.89.36.242 1.0 proxy5.akl1.maxnet.net.nz:8080 (Squid/2.4.STABLE2)) Probable Submitter: 203.167.190.105 (proxied: 1.0 BIGTED) ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.setcookie.php Edit -- http://master.php.net/note/edit/62549 Del: integrated -- http://master.php.net/note/delete/62549/integrated Del: useless -- http://master.php.net/note/delete/62549/useless Del: bad code -- http://master.php.net/note/delete/62549/bad+code Del: spam -- http://master.php.net/note/delete/62549/spam Del: non-english -- http://master.php.net/note/delete/62549/non-english Del: in docs -- http://master.php.net/note/delete/62549/in+docs Del: other reasons-- http://master.php.net/note/delete/62549 Reject -- http://master.php.net/note/reject/62549 Search -- http://master.php.net/manage/user-notes.php