Bug 18807

Summary: Cookie behavior is not as designed
Product: Red Hat Network Reporter: Billy Marshall <marshall>
Component: RHN/Web SiteAssignee: Tom Lancaster <tlancast>
Status: CLOSED CURRENTRELEASE QA Contact: Jay Turner <jturner>
Severity: medium Docs Contact:
Priority: high    
Version: RHN StableCC: marshall, srevivo
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: www.redhat.com/network
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2000-12-21 15:49:37 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Billy Marshall 2000-10-10 13:18:19 UTC
The web site is caching my cookie for too long.  The cookie should expire
after 10 minutes, according to my preferences.  Often, after being away
from the application for days, I will enter the www.redhat.com/network URL
and be taken directly to my main page with no login required.  The
application should require me to login.

Comment 1 Jay Turner 2000-10-18 14:37:29 UTC
*** Bug 19252 has been marked as a duplicate of this bug. ***

Comment 2 Jay Turner 2000-10-25 12:32:23 UTC
*** Bug 18131 has been marked as a duplicate of this bug. ***

Comment 3 Jay Turner 2000-10-25 12:34:26 UTC
OK, so on echen.webdev.redhat.com, the session now times out no matter whether
the user is active or not.  So, with a timeout set to 2 minutes, if I am
actively navigating around the site, after two minutes I will get thrown to a
logged out page.

Comment 4 Jay Turner 2000-10-26 14:45:34 UTC
Fixes were pushed to live site on 10/25.

Comment 5 Jay Turner 2000-11-16 20:33:14 UTC
Reopening bug, as the behavior has returned.  Need to know why this came back .
. . what changed, when, why, etc. so that I can put it on a list of things to
check the next time that piece or section of code changes.

Comment 6 Jay Turner 2000-11-20 14:51:22 UTC
This appears to be working correctly again on live and webdev (11/20; jkt)

Comment 7 Jay Turner 2000-11-30 14:12:08 UTC
And guess what . . . this bug is again back!!

Yes, both webqa and live site are exhibiting this issue again.

On webqa: log in as rhn7_copper; change the timeout to 1 minute; exit Netscape;
wait a few minutes; start Netscape again and go to webqa.redhat.com; click on
the "Free Trial" button and you will automatically be logged in

on live site: log in as rhn7_mocha and follow the above instructions.

Comment 8 Jay Turner 2000-12-15 12:35:52 UTC
Changes pushed to echen.current.webdevel.redhat.com.  Couple of problems there.

Log in as rhn7_copper and then wait for the session to timeout (currently set at
1 minute)  Then attempt to log back into the site.  The first time that you
attempt to log in, will get "document contained no data" message.  Attempting to
log in again will actually log you into the site.

Log in as rhn7_copper and then immediately quit that browser window.  Wait
longer than the timeout amount (currently set at 1 minute) and then open a
window and navigate to the site.  Log in as rhn7_copper and you will immediately
get the "logged out" message (this is good)  User is able to enter username and
password and get logged into the site.  So, there is definitely a code path
issue between the first thing that I described and this one.

Finally issue.  Log into the site as rhn7_copper, then log out using the buttons
on the site.  This should kill off your cookie.  Now, wait longer than the
timeout amount (currently set at 1 minute) and then navigate back to the site. 
Enter the username and password, hit login and will immediately get the logged
out screen.  Have to enter username and password again to get logged into site. 
Since the cookie should not still be active, there should not be a chance to get
timed out.

Comment 9 Jay Turner 2000-12-21 15:49:33 UTC
Code currently in echen.current.webdevel.redhat.com works as it should.  Ready
for push to webqa environment.

Comment 10 Jay Turner 2001-01-10 14:52:42 UTC
This has been pushed to live site and appears to be working correctly (jkt; 1/9/01)