Paths

Table of Contentst

Differential D8537

Tune cookie behaviors for 'phcid', 'phreg', etc
ClosedPublic
Actions

Authored by epriestley on Mar 14 2014, 7:46 PM.

Tags

None

Referenced Files

	F17947529: D8537.id.diff
	Thu, Jul 31, 5:11 PM

	F17945835: D8537.id20258.diff
	Thu, Jul 31, 1:06 PM

	F17937605: D8537.diff
	Thu, Jul 31, 1:23 AM

	Unknown Object (File)
	Jun 21 2025, 12:03 PM

	Unknown Object (File)
	Jun 17 2025, 11:15 PM

	Unknown Object (File)
	Jun 16 2025, 6:40 PM

	Unknown Object (File)
	Jun 16 2025, 6:34 PM

	Unknown Object (File)
	Jun 3 2025, 3:10 PM

Subscribers

Details

Reviewers

Maniphest Tasks

T3471: Be more conservative in overwriting `phcid`

Commits

Restricted Diffusion Commit
rP559c0fe88663: Tune cookie behaviors for 'phcid', 'phreg', etc

Summary

Fixes T3471. Specific issues:

Add the ability to set a temporary cookie (expires when the browser closes).
We overwrote 'phcid' on every page load. This creates some issues with browser extensions. Instead, only write it if isn't set. To counterbalance this, make it temporary.
Make the 'next_uri' cookie temporary.
Make the 'phreg' cookie temporary.
Fix an issue where deleted cookies would persist after 302 (?) in some cases (this is/was 100% for me locally).

Test Plan

Closed my browser, reopned it, verified temporary cookies were gone.
Logged in, authed, linked, logged out.

Diff Detail

Repository

Branch

tempcookie

Lint

Lint Passed

Unit

Tests Passed

Event Timeline

epriestley updated this revision to Diff 20258.Mar 14 2014, 7:46 PM

epriestley retitled this revision from to Tune cookie behaviors for 'phcid', 'phreg', etc.

epriestley updated this object.

epriestley edited the test plan for this revision. (Show Details)

epriestley added a reviewer: btrahan.

epriestley added a task: T3471: Be more conservative in overwriting `phcid`.

Herald added a subscriber: epriestley.Mar 14 2014, 7:46 PM

First I can't have $_GET / $_POST parameters called 'code', and now I can't have $_COOKIE values of 'deleted' ?

Macro suchwow: much sparta such writ

This revision is now accepted and ready to land.Mar 14 2014, 8:06 PM

Yeah, this technically burns users with the username deleted, since it won't prefill in the "Username: ..." field anymore.

We could put some kind of escaping on that cookie if anyone ever complains.

Closed by commit rP559c0fe88663 (authored by @epriestley).

Revision Contents
Changeset List

Path

Size

src/

aphront/

AphrontRequest.php

68 lines

applications/

auth/

constants/

PhabricatorCookies.php

32 lines

controller/

PhabricatorAuthLinkController.php

4 lines

PhabricatorAuthLoginController.php

2 lines

PhabricatorAuthStartController.php

6 lines

Diff 20258

src/aphront/AphrontRequest.php

Loading...

src/applications/auth/constants/PhabricatorCookies.php

Loading...

src/applications/auth/controller/PhabricatorAuthLinkController.php

Loading...

src/applications/auth/controller/PhabricatorAuthLoginController.php

Loading...

src/applications/auth/controller/PhabricatorAuthStartController.php

Loading...