[Edbrowse-dev] Cookies

[Edbrowse-dev] Cookies

[Tyler Spivey]

Here we go.
Browse this page, which is a simple php script I set up:
http://allinaccess.com/cookie.php
The first time you go there, it should set the cookie with an expiration
time of one year.
Set-Cookie: test=ok; expires=Thu, 05-Jan-2017 18:21:29 GMT
So far so good; the page says "test set".
Refresh with rf, we send the cookie.
Cookie: test=ok
Quit Edbrowse and look at the jar.
It's there.
allinaccess.com>FALSE>/>FALSE>1483640489>test>ok
Start it back up,
db4
b http://allinaccess.com/cookie.php
No cookie gets sent.
Is this a bug in the browser, or my script?
If we test with a clean Firefox profile, going to the page sets the
cookie the first time, and says ok the second time after restarting the
browser.

Re: [Edbrowse-dev] Cookies

[Chris Brannon]

The cookie file is not being read, but it's being saved when we quit.
So CURLOPT_COOKIEFILE is effectively ignored.
A long-winded explanation of why is ahead.

In fact, CURLOPT_COOKIEFILE doesn't work with shared handles, and it
isn't really supposed to.
The curl shared handles share an in-memory cookie jar, nothing more,
nothing less.  They don't share file access.  Even the
CURLOPT_COOKIEJAR, which is where curl writes cookies at cleanup, isn't
technically shared among handles at all.  In our case, one handle owns
it, namely global_http_handle, and when that handle is cleaned up, the
contents of that shared in-memory cookie jar get written to the right
place.  CURLOPT_COOKIEFILE is weirder.

When you say curl_easy_setopt(some_handle, CURLOPT_COOKIEFILE,
filename), this does not load cookies from the file immediately.
Apparently, cookies will not be loaded from the file until you make the
first HTTP transfer with some_handle.
If some_handle is part of a share, then cookies from the file are added
to the shared in-memory cookie jar the first time you make a transfer
with some_handle.
We're using global_http_handle to manage our cookie file, but we never
make a transfer from it.  Hence, the file named by CURLOPT_COOKIEFILE
will never be loaded, and its cookies will never be added to the shared
in-memory jar.

I suspect that the best approach will be to just forget
CURLOPT_COOKIEFILE entirely and feed the cookies in manually at
startup.  Ugly, but that's how it goes.

-- Chris