note 96813 added to function.setcookie

A note on setting cookie expiry times, particularly example #2 in which an attempt is made to delete the cookie by setting the expiry to 1 hour (3600 seconds) in the past. The function <? time(); ?> returns the current LOCAL time on the server. Suppose a server is located in New York with a UTC offset of -4. A client connecting from say Australia which has a UTC offset of +10 is 14 hours into the future from the point of view of the server in NY. If the American server attempts to set a session cookie which expires in say 1 hour, this would be interpreted by the client in Australia as a time 13 hours in the past. Naturally, the cookie is deleted on arrival and (depending on the script) the user might never be able to get past the login-correct page. Now looking at the inverse example: Suppose a server is located in Australia with a UTC offset of +10. A client connecting from New York with an offset of UTC-4 is 14 hours in the past as viewed from the Australian server. If the Australian server attempts to clear a cookie as in example #2, like so: <? setcookie ("TestCookie", "", time() - 3600); ?> the client will receive a time that is 13 hours into the FUTURE, and as a result, the cookie will not be cleared. This is a potential security risk if sensitive (which really shouldn't be there in the first place...) or session data (which should be cleared on the server) is left in the cookie. A good minimum value for deleting cookies that takes into account all timezones is 25 hours in the past (3600 * 25), rather than 3600. Of course this would all be a lot easier if every browser was guaranteed to implement cookie expiration in UTC. ---- Server IP: 117.55.229.1 Probable Submitter: 58.168.204.141 ---- Manual Page -- http://www.php.net/manual/en/function.setcookie.php Edit -- https://master.php.net/note/edit/96813 Del: integrated -- https://master.php.net/note/delete/96813/integrated Del: useless -- https://master.php.net/note/delete/96813/useless Del: bad code -- https://master.php.net/note/delete/96813/bad+code Del: spam -- https://master.php.net/note/delete/96813/spam Del: non-english -- https://master.php.net/note/delete/96813/non-english Del: in docs -- https://master.php.net/note/delete/96813/in+docs Del: other reasons-- https://master.php.net/note/delete/96813 Reject -- https://master.php.net/note/reject/96813 Search -- https://master.php.net/manage/user-notes.php