Skip Menu |

Preferred bug tracker

Please visit the preferred bug tracker to report your issue.

This queue is for tickets about the CGI CPAN distribution.

Report information
The Basics
Id: 42990
Status: resolved
Priority: 0/
Queue: CGI
People
Owner: MARKSTOS [...] cpan.org
Requestors: bitcard [...] chimpychompy.org
Cc:
AdminCc:
Bug Information
Severity: Unimportant
Broken in: (no value)
Fixed in: (no value)

History Show all quoted text
  Tue Feb 03 05:32:52 2009 bitcard [...] chimpychompy.org - Ticket created
Subject: httponly cookie option now supported in more browsers than docs say?
The docs (CGI::Cookie) say that only IE6 supports httponly cookie option. However, according to: http://www.codinghorror.com/blog/archives/001167.html Opera 9.5, Internet Explorer 7, and Firefox 3 now support it. Also, accoding to: https://bugs.webkit.org/show_bug.cgi?id=10957 webkit/Safari may be getting there too. Would it be possible to update the docs to say there is more support now (but still not universal, obviously)?
  Tue Apr 07 20:29:59 2009 MARKSTOS [...] cpan.org - Correspondence added
On Tue Feb 03 05:32:52 2009, gss wrote: Show quoted text
> The docs (CGI::Cookie) say that only IE6 supports httponly cookie > option. > > However, according to: > > http://www.codinghorror.com/blog/archives/001167.html > > Opera 9.5, Internet Explorer 7, and Firefox 3 now support it. > > Also, accoding to: > > https://bugs.webkit.org/show_bug.cgi?id=10957 > > webkit/Safari may be getting there too. > > Would it be possible to update the docs to say there is more support > now (but still not > universal, obviously)?
Yes, it is possible. Please submit a doc patch against 3.43. A related issue is that at least one browser will fail to to read the cookie at all if httponly is present. That's IE On the Mac. This could potentially be addressed by silently dropping 'httponly' if we find a useragent that that matches this. This is similar to the approach the MediaWiki takes when dealing with httponly. There related bug report is here: https://bugzilla.wikimedia.org/show_bug.cgi?id=13905
  Tue Apr 07 20:29:59 2009 The RT System itself - Status changed from 'new' to 'open'
  Sun Jul 19 21:19:06 2009 MARKSTOS [...] cpan.org - Taken
  Sun Jul 19 21:19:24 2009 MARKSTOS [...] cpan.org - Subject changed from 'httponly cookie option now supported in more browsers than docs say?' to 'Needs Docs: httponly cookie option now supported in more browsers than docs say?'
  Sun Jul 19 21:19:24 2009 MARKSTOS [...] cpan.org - Broken in 3.43 added
  Sun Jan 20 21:23:32 2013 MARKSTOS [...] cpan.org - Correspondence added
I've now created a patch now to update the docs for HttpOnly to clarify that it is widely supported now.
  Sun Jan 20 21:23:35 2013 MARKSTOS [...] cpan.org - Status changed from 'open' to 'resolved'
  Fri May 23 14:29:29 2014 The RT System itself - Queue changed from CGI.pm to CGI