• From: Leuven, Belgium
  • Registered: 2005-06-14
  • Posts: 2,653

Topic: httpOnly bug in Firefox

I've found a bug with httpOnly in Firefox 2.
Oddly enough, this started to occur after I installed the httpOnly plugin (and continued after I uninstalled it).

Maybe this is a FF2 problem, or maybe this is a PunBB problem, I don't know, but I'd like to see this resolved.

I've tested it on a fresh install of 1.2.14 and can't login with FF2 while IE7 and Opera can =/

Only thing I've noticed as a difference between the cookie in Firefox and Opera is this:
Opera cookie name: 

punbb_cookie

FF2 cookie name (even with the httpOnly plugin uninstalled): 

"hO_punbb_cookie
  • Jansson
  • Former PunBB Developer
  • Offline
  • From: Sweden
  • Registered: 2003-01-06
  • Posts: 856

Re: httpOnly bug in Firefox

hO_ is added by the plugin, so it's probably a problem with that. Why it keeps doing that after you uninstalled it, is a mystery tongue

  • From: Leuven, Belgium
  • Registered: 2005-06-14
  • Posts: 2,653

Re: httpOnly bug in Firefox

Heh. I reinstalled it and then uninstalled it again... and now it works =/ (and the cookie name is punbb_cookie again)

But I think the problem I had logging in was because the cookie name changed and PunBB didn't recognise it.

  • Jansson
  • Former PunBB Developer
  • Offline
  • From: Sweden
  • Registered: 2003-01-06
  • Posts: 856

Re: httpOnly bug in Firefox

elbekko wrote:

But I think the problem I had logging in was because the cookie name changed and PunBB didn't recognise it.

Yeah, and it's not supposed to either.

  • From: 127.0.0.1
  • Registered: 2001-11-02
  • Posts: 9,167

Re: httpOnly bug in Firefox

There's something about this in the comments for Stefans blog post announcing the httpOnly extension:

http://blog.php-security.org/archives/4 … x-2.0.html

"Programming is like sex: one mistake and you have to support it for the rest of your life."

Rickard's Website

  • Smartys
  • Former PunBB Developer
  • Offline
  • Registered: 2004-04-30
  • Posts: 7,844

Re: httpOnly bug in Firefox

Moved to Troubleshooting, since this appears to not be a PunBB bug

  • From: France
  • Registered: 2004-11-06
  • Posts: 695

Re: httpOnly bug in Firefox

But a damn good thread. I just got the same issue (I couldn't disconnect from my board, so I erase the PunBB cookie to go bug hunt, and I found the "hO_ thing). Without it I would never thought of the httponly addon.

The addon is gone, all is fine.

Jeu de rôle en ligne sur table virtuelle ⁂ Shadowrun France ⁂ Chez Blacky

Jérémie's Website