Setting Cookies over secure server

[Dynamo3209]

Hi,
I am facing a strange problem while setting cookies in php.
If I try setting cookies over a secure server (

https://secure.domain.tld)the

cookies are not at all set in the browser.
However if I use

http://domain.tld,the

cookies are set and I am able to get the desired output.
I am not sure if the cookies need to be set in a different manner or some other things need to be taken care of while setting the cookies over an https server.
I am using PHP 4.1.2 version.
Appreciate any help on this.

Thanks,
Mohit.

 

[sleipnir214]

To the best of my knowledge, the manner in which you set cookies does not differ between HTTP and HTTPS.

How are you setting the cookies and testing for the presence of the cookies in HTTPS?



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[Dynamo3209]

Hi slepnir,
I am setting the cookies using setcookie function and checking with
if (isset($_COOKIE['cookiename']))

Thanks,
Mohit

 

[sleipnir214]

Are you doing this all in the same script? Under the PHP manual entry on setcookie(), there is section titled "Common Pitfalls", which reads, in part:

Cookies will not become visible until the next loading of a page that the cookie should be visible for.

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[Dynamo3209]

Nope I am refreshing the page so that the cookies are visibile
before checking for the cookies

 

[sleipnir214]

How many cookies are you setting?
How much total data are you storing?



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[Dynamo3209]

setting 2 cookies one cookie stores the username and the second cookie stores the userid those are used for different purposes.

 

[sleipnir214]

You said in your original post that not all are set in the browser.

Is it one of the two in particular?



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[Dynamo3209]

None of the cookies are set over HTTPS however the same code runs perfectly well over HTTP.

 

[sleipnir214]

So you point your browser to [ignore]

https://secure.domain.tld/somescript.php

[/ignore], which sets the cookie then point your browser to [ignore]

https://secure.domain.tld/somescript.php

[/ignore], but they're not there, right?



Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[Dynamo3209]

when I point my browser to

https://secure.domain.tld/login.php,

the cookies are not set
However if I point my browser to

http://domain.tld/login.php

the script runs perfectly ok.
I make no changes in the script. The only change I make is instead of pointing to https directory I point server to http directory I have duplicated the files on both the directories i.e. secure and non-secure.

 

[sleipnir214]

Perhaps I'm not being explicit enough.

When you are checking for the presence of cookies that were set by a script, are you performing the check within the same domain name in which you set the cookie? For example, if you set the cookie at secure.domain.tld, do you check for the presence of the cookie at secure.domain.tld.

Cookies are domain-specific.



Want the best answers? Ask the best questions!

TANSTAAFL!!