Lazarus

Programming => Networking and Web Programming => Topic started by: engkin on March 17, 2018, 01:37:55 pm

Title: TFPHTTPClient holds the last cookie only
Post by: engkin on March 17, 2018, 01:37:55 pm
I believe this is a bug in TFPCustomHTTPClient. I tracked it down to ReadResponseHeaders:
Code: Pascal  [Select][+][-]
  1. function TFPCustomHTTPClient.ReadResponseHeaders: integer;
  2.  
  3.   Procedure DoCookies(S : String);
  4.  
  5.   Var
  6.     P : Integer;
  7.     C : String;
  8.  
  9.   begin
  10.     If Assigned(FCookies) then    ///  <--------  Bug
  11.       FCookies.Clear;             ///  <-------- /
  12.     P:=Pos(':',S);
  13.     System.Delete(S,1,P);
  14.     Repeat
  15.       P:=Pos(';',S);
  16.       If (P=0) then
  17.         P:=Length(S)+1;
  18.       C:=Trim(Copy(S,1,P-1));
  19.       Cookies.Add(C);
  20.       System.Delete(S,1,P);
  21.     Until (S='') or Terminated;
  22.   end;
  23.  
  24. Const
  25.   SetCookie = 'set-cookie';
  26.  
  27. Var
  28.   StatusLine,S : String;
  29.  
  30. begin
  31.   if not ReadString(StatusLine) then
  32.     Exit(0);
  33.   Result:=ParseStatusLine(StatusLine);
  34.   Repeat
  35.     if ReadString(S) and (S<>'') then
  36.       begin
  37.       ResponseHeaders.Add(S);
  38.       If (LowerCase(Copy(S,1,Length(SetCookie)))=SetCookie) then
  39.         DoCookies(S);
  40.       end
  41.   Until (S='') or Terminated;
  42.   If Assigned(FOnHeaders) and not Terminated then
  43.     FOnHeaders(Self);
  44. end;
It clears FCookies repeatedly instead of accumulating all received cookies.
Title: Re: TFPHTTPClient holds the last cookie only
Post by: torumyax on March 17, 2018, 01:54:50 pm
I haven't tested TFPHTTPClient yet, but is there an official github repository for the TFP** libraries? That would be nice...'cause I'm struggling with TFPHttpServer right now...
Title: Re: TFPHTTPClient holds the last cookie only
Post by: engkin on March 17, 2018, 01:59:30 pm
There is no official github repo. There is an official svn or web (https://svn.freepascal.org/cgi-bin/viewvc.cgi/trunk/packages/fcl-web/)
Title: Re: TFPHTTPClient holds the last cookie only
Post by: torumyax on March 17, 2018, 02:12:01 pm
Thank you for the sharing!
Title: Re: TFPHTTPClient holds the last cookie only
Post by: Thaddy on March 17, 2018, 03:59:59 pm
As long as session cookies are meant, the behavior looks correct to me. If not it is indeed a bug. (But I am a cookie hater: best (intention) and worst (mis-use) idea ever invented. Servers should maintain state, not clients)
Title: Re: TFPHTTPClient holds the last cookie only
Post by: engkin on March 17, 2018, 04:29:17 pm
As long as session cookies are meant, the behavior looks correct to me. If not it is indeed a bug. (But I am a cookie hater: best (intention) and worst (mis-use) idea ever invented. Servers should maintain state, not clients)

Session cookies will get deleted if did not come as the last one in a series of set-cookie headers. For instance consider:
Code: Text  [Select][+][-]
  1. set-cookie: an=123; Expires=Sat, 17 Mar 2018 15:07:39 UTC; Path=/; Domain=.example.com; Secure;
  2. set-cookie: _active_sess=AbCdEf0123; Path=/; Domain=.example.com; Secure;
  3. set-cookie: your_guest_id=AB12CD456; Expires=Mon, 16 Mar 2020 15:07:48 UTC; Path=/; Domain=.example.com
  4. set-cookie: z=15; Expires=Mon, 16 Apr 2018 15:07:48 UTC; Path= /; Domain=.example.com; Secure
Title: Re: TFPHTTPClient holds the last cookie only
Post by: Thaddy on March 17, 2018, 04:44:07 pm
So it is a bug indeed.
Title: Re: TFPHTTPClient holds the last cookie only
Post by: engkin on March 18, 2018, 04:30:21 am
So it is a bug indeed.

Thank you. I'll file a bug report when I get a chance.

Edit:
Filed (https://bugs.freepascal.org/view.php?id=33451).
Title: Re: TFPHTTPClient holds the last cookie only
Post by: Soner on January 24, 2021, 08:19:23 pm
It looks like your bugfix did not solve the bug.
TFPHTTPClient still holds only last cookie in fpc 3.2.1-Svn 62267 and latest svn version.(My fpc  contains your bugfix).

I uploaded  test project with server and httpclient app. Chrome-Browser holds cookie until it is closed, but TFPHTTPClient loses it after second call.

Maybe you should open the bug report again.
Title: Re: TFPHTTPClient holds the last cookie only
Post by: trev on January 25, 2021, 04:52:54 am
It looks like your bugfix did not solve the bug.
[...]
Maybe you should open the bug report again.

engkin has not logged in since April last year. I think you'd do better opening a new bug report and referencing the earlier one.
Title: Re: TFPHTTPClient holds the last cookie only
Post by: Thaddy on January 25, 2021, 09:07:29 am
.(My fpc  contains your bugfix).
It was already applied, do not apply it yourself. 3.2.1 and 3.3.1 both have the patch applied. re-patching it may break your build since many more related things in TfpHttpClient are also fixed.
see https://bugs.freepascal.org/view.php?id=33451 which is back ported to 3.2.1 I believe.
With proper settings only the session cookie is dropped (as it should) I am using daily builds for 3.2.1 and 3.3.1 and so should you. I tested with trunk from yesterday, but not very intensive.
Title: Re: TFPHTTPClient holds the last cookie only
Post by: Soner on January 25, 2021, 09:54:00 pm
engkin has not logged in since April last year. I think you'd do better opening a new bug report and referencing the earlier one.
I will, but I wanted be sure there is still bug. I thought , maybe I am making something wrong.
I uploaded a test project, but still only one person downloaded it.

.(My fpc  contains your bugfix).
It was already applied, do not apply it yourself. 3.2.1 and 3.3.1 both have the patch applied. re-patching it may break your build since many more related things in TfpHttpClient are also fixed.
see https://bugs.freepascal.org/view.php?id=33451 which is back ported to 3.2.1 I believe.
With proper settings only the session cookie is dropped (as it should) I am using daily builds for 3.2.1 and 3.3.1 and so should you. I tested with trunk from yesterday, but not very intensive.
No Thaddy, I did not applied his patch, I downloaded version of 3.2.1 and compiled it. It already contains the patch.  Maybe I said it wrong.
Title: Re: TFPHTTPClient holds the last cookie only
Post by: trev on January 26, 2021, 12:59:08 am
I can confirm the issue with Lazarus 2.1 r64368 FPC 3.3.1 r48100 macOS 10.14.6 Xcode 11.3.1.

Firefox on the other hand works OK.
Title: Re: TFPHTTPClient holds the last cookie only
Post by: engkin on February 17, 2021, 05:14:29 am
It looks like your bugfix did not solve the bug.
TFPHTTPClient still holds only last cookie in fpc 3.2.1-Svn 62267 and latest svn version.(My fpc  contains your bugfix).

I uploaded  test project with server and httpclient app. Chrome-Browser holds cookie until it is closed, but TFPHTTPClient loses it after second call.

Maybe you should open the bug report again.

Hi Soner,

Based on your test project, I think you missunderstood what this bug was about. Your test project sets/clears *one cookie*. The bug I fixed is related to having more than one cookie in the *same* response.

A comment about THTTPClient.cookies in the source code:
Code: Pascal  [Select][+][-]
  1. // Cookies. Set before request to send cookies to server.
  2. // After request the property is filled with the cookies sent by the server.
  3. Property Cookies : TStrings Read GetCookies Write SetCookies;

You are supposed to set the cookies property every time before sending your request. Managing cookies is not part of THTTPClient, the property is a simple TStringList. At least in FPC 3.2.0

IIRC, FCL-Web comes with at least one example that shows how to retain cookies during multiple requests.
TinyPortal © 2005-2018