Cookies and webhop.

[Control Freq]

Hi,
Apologies of you have heard this many times before, but I don't know if
this is a .NET problem or javascript, or something else.

I am using IE6 to view pages from a corporate web server through
internet, not VPN. But, the I use a webhop service, so the URL I use is
silently redirected to another place. I think this is because the
company uses dynamic IP addresses for the server.

Anyway, I am trying to use a cookie to remember user login info, but
the cookie is not working. If connect to the server through the VPN
(when I know the IP address of the server) everything works fine. So, I
am thinking that the webhop thing is causing me a problem with cookie.

Reading about the cookie I think that either the path or the domain
needs setting.
Am I on the right lines here, or is it something else?

Any help appreciated.

Regards

[VK]

I am using IE6 to view pages from a corporate web server through

internet, not VPN. But, the I use a webhop service, so the URL I use is
silently redirected to another place.

Cookies are attached to a particular protocol (http / https) and domain
name. They don't care about IP's. So if you have say
http://webhop.net/foo/bar.html in your address bar then you have to set
cookie for http://webhop.net.
It is irrelevant that this page is really
http://www.corpserver.com/foo.html

[Michael Winter]

VK wrote:

[snip]

Cookies are attached to a particular protocol (http / https) and domain
name. They don't care about IP's. So if you have say
http://webhop.net/foo/bar.html in your address bar then you have to set
cookie for http://webhop.net.
It is irrelevant that this page is really
http://www.corpserver.com/foo.html

Logic would dictate otherwise.

If a cookie is set for the domain webhop.net, then the cookie will only
be sent whilst making a request to host names with that domain suffix.
If the user agent is redirected to www.corpserver.com, it will /not/
send the cookie data for this second request as it is not the same
domain used when setting it.

Mike

[VK]

Michael Winter wrote:

If a cookie is set for the domain webhop.net, then the cookie will only
be sent whilst making a request to host names with that domain suffix.
If the user agent is redirected to www.corpserver.com, it will /not/
send the cookie data for this second request as it is not the same
domain used when setting it.

This is why I said "in your address bar" about the addess. WebHop is
not just a redirect service, it is a DNS redirection service ("server
negotiator" on the recent lingo). It means that user types in
http://www.webhop.net/foo/bar.html and she gets
http://www.webhop.net/foo/bar.html and she has
http://www.webhop.net/foo/bar.html in her browser address bar. The
browser has no means to know (nor does it care) that it is actually
http://www.someallanotherserver.info/index.html
Respectively all cookies has to be set for http://www.webhop.net or
this bird won't fly. As an option one can set a pair of cookies: for
http://www.webhop.net and for http://www.someallanotherserver.info - to
cover all holes.

Overall using DNS redirection services for a *business* solutions is a
very strange approach, especially with VPN involved.

[Control Freq]

VK wrote:

>
Overall using DNS redirection services for a *business* solutions is a
very strange approach, especially with VPN involved.

The VPN is only used by me to get my code to the server. The idea is to
have a corporate web server allowing users to use a company resource
either internally or through the internet. The business in question
doesn't want to waste money on a static IP address when a dynamic one
and the webhop facility is cheaper.

Anyway, I have been investigating the use of the path and domain
properties of the cookie. If I set the domain to anything (even
localhost) the cookies stop working altogether, even when testing on my
laptop.
The only time that cookies work are when I don't set anything in the
domain property, and I run the webserver either locally or I access
webpages on the remote server through VPN. If I try to do it through
the webhop the cookies don't work.

Regards

[Control Freq]

Well, I made some progress.
If I add the URL to the list of trusted sites in Tools|Internet Options
| Privacy (tab) | Sites then I can sort of get the cookies to be
remembered.
The cookie works while I am navigating pages on the site.
However, if I close IE and start a new session then the cookie is not
there!

Regards

[VK]

Control Freq wrote:

Well, I made some progress.
If I add the URL to the list of trusted sites in Tools|Internet Options
| Privacy (tab) | Sites then I can sort of get the cookies to be
remembered.
The cookie works while I am navigating pages on the site.
However, if I close IE and start a new session then the cookie is not
there!

Do you have proper rules set in your P3P file on the server? (If your
answer would be "and what is P3P?" then we've most probably jumped
right on the problem ;-).

In relevance to JavaScript the cookie handling is as simple as
reading/setting document.cookie property and I don't see how it would
affect the issue (though it *may*). Otherwise a more relevant newsgroup
would be <comp.infosystems.www.servers.miscor something else more
HTTP data exchange specific. We may try to end it up here but in this
case an abstract problem description doesn't make the trick any more.
It has to be an URL (not a code sample, but an active URL)
demonstrating the actual problem.

[Control Freq]

VK wrote:

Control Freq wrote:

Well, I made some progress.
If I add the URL to the list of trusted sites in Tools|Internet Options
| Privacy (tab) | Sites then I can sort of get the cookies to be
remembered.
The cookie works while I am navigating pages on the site.
However, if I close IE and start a new session then the cookie is not
there!

Do you have proper rules set in your P3P file on the server? (If your
answer would be "and what is P3P?" then we've most probably jumped
right on the problem ;-).

Well, a compact privacy policy would help but it depends on the
security settings in IE. The default setting would block cookies, but I
have temporarily got around that by adding the URL to the list of
trusted sites.
However, in doing this I noticed that the URL I was using was
incorrect. This is due to the webhop DNS redirection I mentioned in the
OP. So, by using the hidden URL in the domain setting of the cookie I
can now get it all to work. I have also added a compact policy to the
headers so that I don't need to add the URL in the trusted sites list.

Unfortunately, this means that someone can view the page source and see
the underlying URL. I don't know if this is a security risk or not.

Thanks for the suggestions, and help. But, as I suspected, the problem
lay in the domain setting of the cookie all along, I just needed the
correct domain!

>
In relevance to JavaScript the cookie handling is as simple as
reading/setting document.cookie property and I don't see how it would
affect the issue (though it *may*). Otherwise a more relevant newsgroup
would be <comp.infosystems.www.servers.miscor something else more
HTTP data exchange specific. We may try to end it up here but in this
case an abstract problem description doesn't make the trick any more.
It has to be an URL (not a code sample, but an active URL)
demonstrating the actual problem.