note 35395 deleted from function.setcookie by vincent
| From: | vincent@php.net | Date: | Fri, 29 Aug 2003 17:38:59 +0000 |
| Subject: | note 35395 deleted from function.setcookie by vincent | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-55314@lists.php.net to get a copy of this message | ||
Note Submitter: grooou@lycos.com
----
Hi.
Microsoft, in msie6 sp1, produced a patch that solves some cookie vulnerability issues.
Look for details in:
http://support.microsoft.com/default.aspx?scid=kb;en-us;312461
This patch requires that server domains that use cookies MUST (yes, they MUST) only have
alpha-numeric characters (or '-' or '.') in the domain name. (WHY ???????)
If you have a server domain name called 'aaa_test.domain.net' you will have problems
because msie 6 ignores the cookies.
So, be carefull with domain names.
If you use cookies and want to be msie 6 compliant, you can only have alpha-numeric characters (or
'-' or '.') in the server domain name.
Best regards,
Grooou