Bug 18807 - Cookie behavior is not as designed
Summary: Cookie behavior is not as designed
Alias: None
Product: Red Hat Network
Classification: Red Hat
Component: RHN/Web Site
Version: RHN Stable
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Tom Lancaster
QA Contact: Jay Turner
URL: www.redhat.com/network
Keywords: Security
: 18131 19252 (view as bug list)
Depends On:
TreeView+ depends on / blocked
Reported: 2000-10-10 13:18 UTC by Billy Marshall
Modified: 2015-01-07 23:42 UTC (History)
2 users (show)

Clone Of:
Last Closed: 2000-12-21 15:49:37 UTC

Attachments (Terms of Use)

Description Billy Marshall 2000-10-10 13:18:19 UTC
The web site is caching my cookie for too long.  The cookie should expire
after 10 minutes, according to my preferences.  Often, after being away
from the application for days, I will enter the www.redhat.com/network URL
and be taken directly to my main page with no login required.  The
application should require me to login.

Comment 1 Jay Turner 2000-10-18 14:37:29 UTC
*** Bug 19252 has been marked as a duplicate of this bug. ***

Comment 2 Jay Turner 2000-10-25 12:32:23 UTC
*** Bug 18131 has been marked as a duplicate of this bug. ***

Comment 3 Jay Turner 2000-10-25 12:34:26 UTC
OK, so on echen.webdev.redhat.com, the session now times out no matter whether
the user is active or not.  So, with a timeout set to 2 minutes, if I am
actively navigating around the site, after two minutes I will get thrown to a
logged out page.

Comment 4 Jay Turner 2000-10-26 14:45:34 UTC
Fixes were pushed to live site on 10/25.

Comment 5 Jay Turner 2000-11-16 20:33:14 UTC
Reopening bug, as the behavior has returned.  Need to know why this came back .
. . what changed, when, why, etc. so that I can put it on a list of things to
check the next time that piece or section of code changes.

Comment 6 Jay Turner 2000-11-20 14:51:22 UTC
This appears to be working correctly again on live and webdev (11/20; jkt)

Comment 7 Jay Turner 2000-11-30 14:12:08 UTC
And guess what . . . this bug is again back!!

Yes, both webqa and live site are exhibiting this issue again.

On webqa: log in as rhn7_copper; change the timeout to 1 minute; exit Netscape;
wait a few minutes; start Netscape again and go to webqa.redhat.com; click on
the "Free Trial" button and you will automatically be logged in

on live site: log in as rhn7_mocha and follow the above instructions.

Comment 8 Jay Turner 2000-12-15 12:35:52 UTC
Changes pushed to echen.current.webdevel.redhat.com.  Couple of problems there.

Log in as rhn7_copper and then wait for the session to timeout (currently set at
1 minute)  Then attempt to log back into the site.  The first time that you
attempt to log in, will get "document contained no data" message.  Attempting to
log in again will actually log you into the site.

Log in as rhn7_copper and then immediately quit that browser window.  Wait
longer than the timeout amount (currently set at 1 minute) and then open a
window and navigate to the site.  Log in as rhn7_copper and you will immediately
get the "logged out" message (this is good)  User is able to enter username and
password and get logged into the site.  So, there is definitely a code path
issue between the first thing that I described and this one.

Finally issue.  Log into the site as rhn7_copper, then log out using the buttons
on the site.  This should kill off your cookie.  Now, wait longer than the
timeout amount (currently set at 1 minute) and then navigate back to the site. 
Enter the username and password, hit login and will immediately get the logged
out screen.  Have to enter username and password again to get logged into site. 
Since the cookie should not still be active, there should not be a chance to get
timed out.

Comment 9 Jay Turner 2000-12-21 15:49:33 UTC
Code currently in echen.current.webdevel.redhat.com works as it should.  Ready
for push to webqa environment.

Comment 10 Jay Turner 2001-01-10 14:52:42 UTC
This has been pushed to live site and appears to be working correctly (jkt; 1/9/01)

Note You need to log in before you can comment on or make changes to this bug.