473,805 Members | 1,956 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Cookie timeout and timezones

I just figured out a rather puzzling problem I had with a cookie
apparently being ignored. I had it set to timeout in 3 minutes and it
worked fine tested on localhost, but sometimes failed when different
machines connected. The problem was that some of my test machines had
system clocks that weren't quite correct, and the cookie was effectively
timing out as soon as the browser received it. There's a lesson learned. :o}

So I switched from 3 minutes to an hour, then started pondering how much
a skewed system clock I should worry about. This is a security related
issue for my site so I didn't want to use a session cookie. That then
got me thinking about timezones...

Suppose my server is in London - UTC, GMT+0. I set my cookie to expire
in 1 hour. Someone in New York (GMT-5) connects - do they get to keep
the cookie for 6 hours? What about someone in Australia (GMT+10)? Do
they loose their cookie as expired as soon as they see it?

I read up on the issue and decided to use session cookies with a
timestamp in the data so I know exactly what is going on. But I'm still
interested in the answer to the above question. Unless there's something
going on I don't understand, it seems that cookie timeouts are not much
use for periods less than 24 hours or so, simply because of timezone issues.
Aug 15 '05 #1
1 1819
On Mon, 15 Aug 2005 19:49:02 +0100, Derek Fountain <no****@hursley .ibm.com>
wrote:
Suppose my server is in London - UTC, GMT+0. I set my cookie to expire
in 1 hour. Someone in New York (GMT-5) connects - do they get to keep
the cookie for 6 hours? What about someone in Australia (GMT+10)? Do
they loose their cookie as expired as soon as they see it?


The cookie spec states that the expiry time shall be in GMT:

http://wp.netscape.com/newsref/std/cookie_spec.html

If the user has their timezone set wrong then things go wrong, but otherwise
you're only working against with their clock drift (which is hopefully in the
region of a few minutes at worst) rather than timezone offsets.

--
Andy Hassall / <an**@andyh.co. uk> / <http://www.andyh.co.uk >
<http://www.andyhsoftwa re.co.uk/space> Space: disk usage analysis tool
Aug 15 '05 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

4
11728
by: dan glenn | last post by:
Say, I want to set a cookie and have it expire an hour after it's set. It's looking like this is only possible for browsers which are in the same time zone as my server?? In other words, if I set my cookie with: setcookie('CookieName', $SomeValue, time()+3600, "/");
7
2148
by: Christoph Pieper | last post by:
Hi, we've the following problem : We have an asp-application which sets the cookie on first login. The cookie will never be touched during user access. The user can work the whole day, but after 6 to 7 hours, the cookie get 2-4 new asp-sessionid's thus overwriting the very first entries in the cookie. Does anyone had the same problem or has a solution. The server is a w2003 enterprise the client has windows xp sp2.
0
1035
by: Sebastien Roeckel | last post by:
Hello I have a problem with the authentication cookie timeout in a forms authentication. I've developed a Web application that uses forms authentication. My web.config is configured for the authentication cookie to expire after 30 minutes. The login page asks for the user's credentials and if OK, writes the authentication cookie (through the
0
1897
by: Kepler | last post by:
I'm testing very basic FormsAuthentication and having trouble with non-persistent cookies. Once authenticated with a non-persistent cookie, if I leave the browser alone for 30 minutes, Request.IsAuthenticated returns false on my next request. WHY? At first I thought it had to do with session timeout, but session timeout is set to 20 minutes, and I'm still authenticated after 20 minutes. Thirty minutes is the magic number. I'm at a loss...
0
1294
by: briand | last post by:
I have the following code in my base page to redirect to a session timeout page. override protected void OnInit(EventArgs e) { base.OnInit(e); //It appears from testing that the Request and Response both share the
2
1492
by: Martin Dew | last post by:
Hi, I am using ASP.Net for a website, I use the following code; <authentication mode="Forms"> <forms name=".ADASTRATEAROUNDS" loginUrl="login.aspx" protection="All" timeout="30" path="/"> </forms>
8
3185
by: bashful.belle | last post by:
I'm using Forms authentication and a non persistent cookie in my asp.net application. How do i get the cookie to time out after a period of inactivity, say 10 minutes, and force the user to login again? If I close the browser, the next time I use the application, it makes me log in - and That's fine. However if I keep the browser session open, it keeps my login valid for as long as the browser is open - I want it to time out. Specifying...
15
2152
by: Edwin Knoppert | last post by:
I have searched but info is limitted. In my test app i used a non persistant cookie for forms authentication. slidingExpiration is set to true On run and close and rerun the login remains ok. I have a time-out of one minute and indeed, it directs me to the login if i wait to long. The slidingExpiration does it's work also.
5
2229
by: SJ | last post by:
Hi, In my website, i have a cookie that allows the user to remain logged in for upto 90days. So I'm setting the cookie expiration time to 90 days in the future from the time the user logs in. I've been testing my code and for some reason, the cookie expires randomly before even 24 hrs has passed. Yesterday it expired after 11hrs and 20mins. Any idea why my cookie expiration isn't working?
0
10607
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
0
10359
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...
0
10104
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
0
9182
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
6875
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5541
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
5677
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
4317
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
3
3007
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.