I found that the cookie_domain configured on settings.php was not properly honoured, I think using whatever drupal sets for its global variables a better approach.

CommentFileSizeAuthor
#2 authcache-better_cookie_defaults-2792975-2.patch777 byteshanoii
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

hanoii created an issue. See original summary.

hanoii’s picture

hanoii
Primary language Spanish
Location 🇦🇷UTC-3
CreditAttribution: hanoii commented
Status: Active » Needs review
FileSize
authcache-better_cookie_defaults-2792975-2.patch777 bytes

Status: Needs review » Needs work

The last submitted patch, 2: authcache-better_cookie_defaults-2792975-2.patch, failed testing.

The last submitted patch, 2: authcache-better_cookie_defaults-2792975-2.patch, failed testing.

The last submitted patch, 2: authcache-better_cookie_defaults-2792975-2.patch, failed testing.

The last submitted patch, 2: authcache-better_cookie_defaults-2792975-2.patch, failed testing.

The last submitted patch, 2: authcache-better_cookie_defaults-2792975-2.patch, failed testing.

hanoii’s picture

hanoii
Primary language Spanish
Location 🇦🇷UTC-3
CreditAttribution: hanoii commented

I am not sure why these are failing. I tried to run them, but on my local it behaves the same with or without the patch.

znerol’s picture

znerol CreditAttribution: znerol commented

When running tests, make sure there is no configuration but the mysql connection and the hash salt in your settings.php.

znerol’s picture

znerol CreditAttribution: znerol commented
Status: Needs work » Postponed (maintainer needs more info)

All cookie related ini settings are initialized during a normal bootstrap from within drupal_settings_initialize() and drupal_environment_initialize().

Especially note the following snipped from drupal_settings_initialize():

  // Per RFC 2109, cookie domains must contain at least one dot other than the
  // first. For hosts such as 'localhost' or IP Addresses we don't set a cookie domain.
  if (count(explode('.', $cookie_domain)) > 2 && !is_numeric(str_replace('.', '', $cookie_domain))) {
    ini_set('session.cookie_domain', $cookie_domain);
  }

So the respective ini-setting is changed, but only only if $cookie_domain is valid. For that reason I think that using ini_get('session.cookie_domain') is safer than using the value directly.

What exactly is the problem you observed? How did you configure your site?

znerol’s picture

znerol CreditAttribution: znerol commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)

Closing since there was no feedback.