RemoteObject PHPSESSID issue SDK0.9.7##1086

[cristallium]

Hi,

It seem there is a bug with mx:RemoteObject and PHPSESSID.
When using it for first time, it should memorise the PHPSESSID sended by remote host. Then using it another time, it should send this PHPSESSID in the request header.

I took exemple in
examples\mxroyale\RemoteObjectAMFTest

I modify it to call my test login service, and clic on sendLogin button.
Here is network trace :

On first packet, then Request has no PHPSESSID because it's first use

On second packet (and others if clic again on sendLogin button) there is no PHPSESSID in Request header.
So the server send each time another new PHPSESSID thinking it's a new client

Now here is same service with Flex sdk4.6.0

Here is the code used :

<j:Application xmlns:fx="http://ns.adobe.com/mxml/2009"
               xmlns:j="library://ns.apache.org/royale/jewel"
               xmlns:js="library://ns.apache.org/royale/basic"
               xmlns:mx="library://ns.apache.org/royale/mx"
               >

    <fx:Style source="../../main/resources/styles.css"/>

    <fx:Script>
		<![CDATA[
            import mx.rpc.AsyncToken;
            import mx.rpc.Responder;
            import mx.rpc.events.FaultEvent;
            import mx.rpc.events.ResultEvent;
            import org.apache.royale.events.Event;


			private function onFault(evt:FaultEvent):void
			{
                trace("[onFault]", evt);
			}

            // Test AsyncToken - Responder
            private var token:AsyncToken;
            private var responder:Responder;
            private function sendEcho(evt:MouseEvent):void
			{
                var o:Object = new Object();
				o.login = "demo";
				o.password = "demo";

                responder = new Responder(onEchoResult, onFault);
                token = serviceResp.siteLogin(o);
                token.addResponder(responder);
                trace(token);
            }

            private function onEchoResult(event:ResultEvent):void
			{
                trace("[onEchoResult]", event);
                result_txt.text = event.result as String;
            }

 
		]]>
	</fx:Script>

    <fx:Declarations>
        <mx:RemoteObject id="serviceResp" fault="onFault(event)"
                         endpoint="http://gateway.XXXXXX.com/gateway.php"
                         source="aadmin"
                         destination="amfphp"/>
    </fx:Declarations>

    <j:beads>
        <js:ClassAliasBead />
    </j:beads>

    <j:valuesImpl>
		<js:SimpleCSSValuesImpl />
	</j:valuesImpl>

    <j:initialView>
	    <j:ApplicationResponsiveView>
        <j:VGroup width="400">
            <j:Button text="Send LOGIN" click="sendEcho(event)"/>
            <j:Label id="result_txt"/>
        </j:VGroup>
        </j:ApplicationResponsiveView>
    </j:initialView>
</j:Application>

Remote server is using AMFPHP (I can give remote URL to test if necessary in private)

Regards

[cristallium]

Hi Guys,

I'm not sure but perhaps the issue is a side effect of using Chrome with --disable-web-security.

Effectively, reading http://software-troubleshooter.blogspot.com/2016/12/reactjs-with-php-cookiescorssession-id.html it suggest it may be the same issue.

The fact is I don't have the issue in production, but only at dev time when running from visual studio code (and with Chrome) and server is remote server.

So it would be nice if someone could make this test (confirm he has the same issue using Chrome with --disable-web-security or if there is a real issue

Regards

[greg-dove]

Bonjour Fred - I can try to help if you are able to share the remote URL where I can repro the issue. I will send you a separate email directly.

[cristallium]

Bonjour Greg ;)
Thank you very much, I send you project test case and remote URL, you will need just run it and see logs
Thank a lot !

[cristallium]

Greg,

I just send you test case and remote URL on your email.

I just test again and, now I have this console debug message (I didn't remember having this last time) :

A cookie associated with a cross-site resource at http://xxxxxxx/ was set without the SameSiteattribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set withSameSite=NoneandSecure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

I'm pretty sure this is the source of the issue. It seem, now setCookie must have 'SameSite' attribute.

Unfortunaly looking at folowing URL we can only set it with 7.3.0 php :
https://www.php.net/manual/en/function.session-set-cookie-params.php

So it seems a issue with Chrome since v80 and not Apache Royale.

Could you give me your opinion ?

Thank again a lot !