Bug 107377 - Cookies served via cross-domain images are ignored
Summary: Cookies served via cross-domain images are ignored
Status: RESOLVED WORKSFORME
Alias: None
Product: konqueror
Classification: Applications
Component: kcookiejar (other bugs)
Version First Reported In: unspecified
Platform: unspecified Linux
: NOR normal
Target Milestone: ---
Assignee: Unassigned bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-06-14 07:47 UTC by Alexandra Walford
Modified: 2011-10-23 14:29 UTC (History)
1 user (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandra Walford 2005-06-14 07:47:44 UTC
Version:            (using KDE KDE 3.4.1)
Installed from:    Unlisted Binary Package
OS:                Linux

Cookies served via (e.g.) images residing on a different domain to the document itself are ignored, regardless of Konqueror's 'Only accept cookies from originating server' and session cookie options - even though these cookies are not (IMHO) cross-domain cookies.

Steps to reproduce:
1. create a simple test webpage on one server (domain1.com/test.html) which references an image on another server (domain2.com/test.gif).
2. create the test image (domain2.com/test.gif) and set up (e.g., for apache) mod_rewrite to set a cookie for domain2.com when serving the image.
3. visit domain1.com/test.html.

Actual behaviour:
No cookie is set.

Expected behaviour:
A cookie from domain2.com should appear in the Configure Konqueror -> Cookies -> Management section.  (Depending on the user's cookie configuration; I have tested & confirmed with a new, unconfigured account.)

Notes:
If the image resides on the same server as the document (e.g., domain1.com/test.html references domain1.com/test.gif), the cookie is properly set for domain1.com, as expected.

I understand that this behaviour may in fact be intentional (since I guess it's a way for unscrupulous tracking companies to do business) - but IMHO it should be controlled by the 'Only accept cookies from originating server' setting or a similar setting.
Comment 1 Dawit Alemayehu 2011-10-23 14:29:41 UTC
Unable to reproduce this in KDE 4.x. Feel free to reopen if you still experience this in the most recent releases of KDE, v4.7.2 as of this response. Sorry about the very very late response.