Skip to content

Conversation

TechAlchemistry
Copy link
Contributor

@TechAlchemistry TechAlchemistry commented Apr 24, 2017

It breaks a cookie values.
Encoding should be on a client side.

@gsouf
Copy link
Member

gsouf commented Apr 24, 2017

Hi @RubtsovAV

Please can you give example of what exactly fails?

@TechAlchemistry
Copy link
Contributor Author

TechAlchemistry commented Apr 24, 2017

For example, the curl get response with that header:

Set-Cookie: GOOGLE_ABUSE_EXEMPTION=ID=09809180ab14776d:TM=1493073384; path=/; domain=google.ru; 

In the cookie jar file, you will get that:

google.ru	FALSE	/	FALSE	1508838244	GOOGLE_ABUSE_EXEMPTION	ID=09809180ab14776d:TM=1493073384

How you can see, the cookie value is not urlencoded. The CURL does not do this.

On the next request (after parse and generate cookie file), you will get that:

google.ru	FALSE	/	FALSE	1508838244	GOOGLE_ABUSE_EXEMPTION	ID%3D09809180ab14776d%3ATM%3D1493073384

And here we get a wrong cookie value. The CURL will send the cookie value as it is - without urldecode.

This PR will fix it.

@gsouf
Copy link
Member

gsouf commented Apr 25, 2017

I have to give further investigations because this change was introduced by #14

@Eropi4 you if you have any details that can help to solve this, feel free to tell us about.

@TechAlchemistry
Copy link
Contributor Author

I'm 100% sure. You can check it yourself.

@TechAlchemistry
Copy link
Contributor Author

TechAlchemistry commented Apr 25, 2017

cookie.php

<?php

$ch = curl_init("http://localhost/setcookie.php");

$cookieFile = dirname(__FILE__).'/cookie.file';
$cookieJarFile = dirname(__FILE__).'/cookie.jar';
file_put_contents($cookieFile, '');
file_put_contents($cookieJarFile, '');

curl_setopt($ch, CURLOPT_COOKIEFILE, $cookieFile);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookieJarFile);

curl_exec($ch);
curl_close($ch);

readfile($cookieJarFile);

setcookie.php

<?php
header('Set-Cookie: special_chars=!#$%&\'()*+-./:<=>?@[]^_`{|}~; path=/;');
echo 'cookie was setted';

When you launch the cookie.php, you will see:

# Netscape HTTP Cookie File
# http://curl.haxx.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

localhost	FALSE	/	FALSE	0	special_chars	!#$%&'()*+-./:<=>?@[]^_`{|}~

CURL does not urlencode the value of a cookie.

@gsouf
Copy link
Member

gsouf commented Apr 25, 2017

I dont tell you are wrong, but I need to know what was wrong, with both of your case and the case in #14.

If we want to fix the issue correctly we need to fully understand both cases, what was wrong and why.

Because if we come back to the previous behaviour and if other persons still open an issue because they need to url encode cookie values we will do that indefinitely. The issue might be of any nature, it can be due different curl version, or it can be due to something we dont consider at this moment.

For the moment I need to test.

@TechAlchemistry
Copy link
Contributor Author

TechAlchemistry commented Apr 25, 2017

I understand, I just tell more information about this issue: all what I know and how I test it. I hope it will help to understand the problem sooner.

@gsouf
Copy link
Member

gsouf commented Dec 19, 2017

There are no clear rules on encoding for coookies, the commonly accepted solution is apparently to not encode anything appart colons semicolons and whitespaces. I need to make sure before going further

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants