Issue 23955: setcookie() to send Max-Age attribute #238

narfbg · 2012-12-05T12:09:53Z

setcookie() should send not only the Expires, but also the Max-Age attribute.
Changed the session extension to send the Max-Age attribute as well.

As described in #23955, a user agent having an erroneously configured timezone would have issues when calculating when to expire the cookie.

As described in RFC6265, Max-Age must be implemented by user agents in the following manner:

Specifies delta time in seconds and when present.
Has precedence over Expires, when both are present.
User agents that don't support it should simply ignore it.

Given those characteristics, it only makes sense that both Expires and Max-Age are sent together.

This MIGHT also fix #43439, but I'm not really sure about it - should be checked.

Edit:

https://wiki.php.net/rfc/cookie_max-age

Signed-off-by: Andrey Andreev <narf@bofh.bg>

weltling · 2012-12-06T09:24:09Z

Reading the specs, both expires and max-age are optional:

If a cookie has both the Max-Age and the Expires attribute, the Max-
Age attribute has precedence and controls the expiration date of the
cookie. If a cookie has neither the Max-Age nor the Expires
attribute, the user agent will retain the cookie until "the current
session is over" (as defined by the user agent).

Also, max-age can be negative.

I'd rather add a new arg to setcookie and let it up to user which combination of attributes he want's to send. That needs probably a small RFC and discussion.

Also - that attributes are case sensitive.

And even though - a test is always needed :)

lstrojny · 2012-12-06T09:27:39Z

Yes, this definitely needs an RFC. Besides that, it’s a good idea.

narfbg · 2012-12-06T09:49:40Z

Fixed the negative values - good point!

However, while adding another parameter to allow the user a choice of attributes would need an RFC, I don't see why this one would require that. The goal is to solve a problem, not just allow the user to solve it.
If both Expires and Max-Age are optional AND can be sent together - why the need to complicate it, if it has always sent Expires up to this point?

And yes - the attributes should be implemented in a case-sensitive way, that's why I've changed them. All of the RFCs that I read (the one linked in the PR description and those mentioned in the linked PHP bug IDs) mention them with an upper-case letter for each word in the attribute name.

Otherwise feel free to suggest any improvements on my code. I'm no C programmer and I've only written a few patches through the years. This one just seemed easy to do. :)

weltling · 2012-12-06T11:48:36Z

That's for instance what stands in the linked document.

If the attribute-name case-insensitively matches the string
"Expires", the user agent MUST process the cookie-av as follows.

The C coding looks fine so far, though i haven't tested yet.

The point about how to implement that is exactly what an RFC should solve. I get your idea not to complicate it now :) . Please look here for which RFCs already exist https://wiki.php.net/rfc . Once the RFC is there, give a note on the internals list. There will be sure more questions and improvements.

Also the tests are still a must :)

narfbg · 2012-12-06T14:00:23Z

So they say that the comparison is made in a case-insensitive manner (I'm assuming that, as nothing is mentioned about case-sensitive matches at all) - representing the attributes as they are specified in the RFC still doesn't hurt. I'm not getting what the argument here is all about - just trying to be consistent with the RFC. :)

I've read some of the RFCs at wiki.php.net, haven't used internals though. I have to post on both, you say?

I'll see what I can do about those tests. :)

weltling · 2012-12-06T14:36:25Z

Of course that capitals don't hurt, there was just not need for that and the patch would be cleaner.

First write an RFC (you'll need a wiki account probably), then expose it on internals. Everything happens for the first time somewhen :)

narfbg · 2012-12-07T12:25:53Z

My original code produced segmentation faults, now it works, with tests for setcookie() added. :)
I'll get on the RFC now.

narfbg · 2012-12-07T12:31:14Z

If only I had permissions to create pages on the wiki ...

lstrojny · 2012-12-15T13:40:23Z

That’s actually a turing test for people writing RFC. Can you find out how to get a Wiki account? :)

narfbg · 2012-12-15T19:01:34Z

I have one, the problem is that all pages are read-only and when I try to access a non-existent page it shows a suggestion that I can create it by clicking on a "Create this page" button, but no such button is shown anywhere.

asifrust · 2012-12-15T19:36:53Z

When PHP 5.5.0 be officially stable released?

narfbg · 2012-12-19T13:48:38Z

I wrote about this on internals a week ago, btw: http://marc.info/?l=php-internals&m=135514355208843

Since the wiki appears to be read-only (again, I have an account), do I have to do anything else than just wait for it to gain attention?

@asifsaif90 This isn't the right place to ask, but they're still discussing the release schedule, so I don't think that anybody could answer you anyway.

weltling · 2012-12-20T14:01:45Z

Have you read the notes on the wiki registration page? There are some more steps needed to become write access.

narfbg · 2012-12-20T14:07:47Z

Oh, right ... thanks @weltling.
I had registered a few months ago and didn't need write access at the time, so I've completely ignored that part and didn't need to revisit the registration form again. I'll get on that now.

narfbg · 2012-12-28T02:27:46Z

Updated the description with a link to the RFC.

smalyshev · 2012-12-28T07:03:22Z

ext/session/session.c

@@ -1201,6 +1202,11 @@ static void php_session_send_cookie(TSRMLS_D) /* {{{ */
 			smart_str_appends(&ncookie, COOKIE_EXPIRES);
 			smart_str_appends(&ncookie, date_fmt);
 			efree(date_fmt);
+
+			char maxage[12];
+			sprintf(maxage, "%li", PS(cookie_lifetime));


Please use snprintf or spprintf, never sprintf. Also, in this case probably smart_str_append_long would be appropriate.

narfbg · 2012-12-29T21:16:29Z

OK, hopefully it's all good to go now.

smalyshev · 2013-01-02T03:07:04Z

looks ok now

narfbg · 2013-01-04T09:17:24Z

Great, I guess I'll be just waiting for it to get merged then. :)
Btw, could any of you guys link the RFC at wiki.php.net/rfc ? I don't have access to edit the list in there and I didn't get a response when I mailed webmaster@ about it.

lstrojny · 2013-01-04T10:44:29Z

@smalyshev will you merge or should I?

php-pulls · 2013-01-06T02:24:59Z

Comment on behalf of lstrojny at php.net:

Merged in 5.5 and master. Thanks for your contribution!

amersabag · 2013-11-13T18:56:03Z

I am sorry to say that, but his commit caused me some troubles.
The idea is great, but the way it was implemented is not complete.
You either allow some flag to disable it, or allow some way to define the current time stamp which this max-age can be calculated based on.
The problem is that, when I make a comparative test between two versions of my code, my code will maintain single value for the time stamp through over the two versions. But because this max-age addition, now, the headers are never matched between the two versions. And I need now to delete this part from all over the tests I do before comparing the two results.

Please, add some way to determine the time stamp of the max-age of the cookie, some way to disable its output completely, or any pretty solution to this matter.

narfbg · 2013-11-13T19:25:34Z

Tests ARE included in the patch and they are in pure PHP, predicting the value is easy.

amersabag · 2013-11-13T19:53:39Z

Deleting it is much easier!
Actually I am talking about testing two PHP sites. Each one is returning html and headers. I do a comparative test between the two sites in millions of pages simulating the actual load while testing/comparing. Now, I need to modify all my tests to delete max-age cookie part before comparing. I found no way to make the cookie both numeric and dates values come in specific value if they are executed in different clock time.

In other way to explain, I set the time stamp of the request for both sites to be equal value, so all dates and functions will use that stamp for both sites. Previously, the cookie got its value only from the stamp I provide. Now, the max-age value is determined by subtracting the actual value (not the one I set and I found no way to control it) of now() time stamp from the time stamp I provide for expiration.

smalyshev · 2013-11-30T21:56:21Z

http://xkcd.com/1172/

narfbg added 2 commits December 5, 2012 13:55

Issue 23955: setcookie() to send Max-Age attribute

290f6b3

Signed-off-by: Andrey Andreev <narf@bofh.bg>

setcookie() accepts a UNIX timestamp, not TS delta

e1618d4

narfbg added 2 commits December 6, 2012 11:31

Another two fixes

7917c9b

Allow negative values

0907512

Really fix and test the code

07fb196

smalyshev reviewed Dec 28, 2012
View reviewed changes

narfbg added 2 commits December 28, 2012 17:54

Apply improvements suggested by @smalishev, @KalleZ

34b574a

Revert attributes case-changes

9f0d8c3

php-pulls closed this Jan 6, 2013

narfbg deleted the session_max-age branch January 6, 2013 02:30

narfbg mentioned this pull request Apr 4, 2013

Unstable CI Session bcit-ci/CodeIgniter#2384

Closed

einkoro mentioned this pull request Apr 24, 2014

Fix for setting multiple cookies with the same name and added max-age support facebook/hhvm#2526

Closed

dunglas mentioned this pull request Sep 17, 2023

Segmentation fault when building Symfony cache on Alpine #12234

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Issue 23955: setcookie() to send Max-Age attribute #238

Issue 23955: setcookie() to send Max-Age attribute #238

narfbg commented Dec 5, 2012

weltling commented Dec 6, 2012

lstrojny commented Dec 6, 2012

narfbg commented Dec 6, 2012

weltling commented Dec 6, 2012

narfbg commented Dec 6, 2012

weltling commented Dec 6, 2012

narfbg commented Dec 7, 2012

narfbg commented Dec 7, 2012

lstrojny commented Dec 15, 2012

narfbg commented Dec 15, 2012

asifrust commented Dec 15, 2012

narfbg commented Dec 19, 2012

weltling commented Dec 20, 2012

narfbg commented Dec 20, 2012

narfbg commented Dec 28, 2012

smalyshev Dec 28, 2012

narfbg commented Dec 29, 2012

smalyshev commented Jan 2, 2013

narfbg commented Jan 4, 2013

lstrojny commented Jan 4, 2013

php-pulls commented Jan 6, 2013

amersabag commented Nov 13, 2013

narfbg commented Nov 13, 2013

amersabag commented Nov 13, 2013

smalyshev commented Nov 30, 2013

Issue 23955: setcookie() to send Max-Age attribute #238

Issue 23955: setcookie() to send Max-Age attribute #238

Conversation

narfbg commented Dec 5, 2012

weltling commented Dec 6, 2012

lstrojny commented Dec 6, 2012

narfbg commented Dec 6, 2012

weltling commented Dec 6, 2012

narfbg commented Dec 6, 2012

weltling commented Dec 6, 2012

narfbg commented Dec 7, 2012

narfbg commented Dec 7, 2012

lstrojny commented Dec 15, 2012

narfbg commented Dec 15, 2012

asifrust commented Dec 15, 2012

narfbg commented Dec 19, 2012

weltling commented Dec 20, 2012

narfbg commented Dec 20, 2012

narfbg commented Dec 28, 2012

smalyshev Dec 28, 2012

Choose a reason for hiding this comment

narfbg commented Dec 29, 2012

smalyshev commented Jan 2, 2013

narfbg commented Jan 4, 2013

lstrojny commented Jan 4, 2013

php-pulls commented Jan 6, 2013

amersabag commented Nov 13, 2013

narfbg commented Nov 13, 2013

amersabag commented Nov 13, 2013

smalyshev commented Nov 30, 2013