Session cookies being deleted without being coded to do so

This site is best viewed in a modern browser with JavaScript enabled.

Session cookies being deleted without being coded to do so

WolfShade

Hello, everyone.

Aside from using code to delete a JavaScript session cookie, what can arbitrarily overwrite/delete a JavaScript session cookie?

I ask because I have something that is working flawlessly in development; but as soon as it's moved into a staging area for testing, it stops working.

My initial thought was that there is something causing the browser to think that it's being redirected to another domain, thereby deleting the session. But further testing indicates this is not the case.

Basically put, I have a detail page for clients that contains nine categories; all categories are loaded in an "expanded" state (shows all information for each category) and has a "hide" link next to the header. Click "hide" and the whole category collapses, and the link becomes "expand"; click "expand" and vice-a-versa.

Also on initial page load, the document looks for a session cookie called "vddstatus"; if it does not exist, it creates the session cookie with default values set so that all categories are expanded; if it does exist, it checks the values and adjusts the expanded/hidden status as needed. This way, no matter what page you go to, when you come back to the details page, it remembers the expanded/hidden status of each category.

Like I said, on the development server it works excellently; in the staging environment, the only time it remembers the category statuses is if you click "HIDE ALL"; anything else it apparently deletes the session cookie and generates a new one, set to all categories expanded.

Any idea what could be causing this in staging but not in development?

Thanks,

WolfShade

Follow up question: Can a JavaScript session cookie be erased in a clustered environment?

I assumed that since the session exists in the browsers memory, it would not be affected by a clustered server setup - as long as it stayed in the same domain with every click.

WolfShade

No one can tell me if JavaScript session cookies are affected by clustered server environment? Does anyone know of anything that can cause JavaScript session cookies to destruct without being instructed to do so?

Tcobb

The only thing I know of (and this probably isn't applicable to your problem) is when a site places a lot of cookies on the visitors browser. There are browser specific limits as to the size and number of cookies that will be accepted. I have also seen a situation before where two different cookies for two different purposes (one set by javascript the other on the server side) were given the same name, and were effectively overwriting one another.

Sorry--that's all I can think of.

WolfShade

Thanks for the reply, Tcobb. Unfortunately, the cookie is being given a unique name, and the information is small enough that it isn't coming close to capacity for cookie value limit. And the weird thing is that if "hide all" is clicked, throwing all categories into hidden mode, it will remember that; but if you click on just one category "expand" link, the cookie is reset to default. There's nothing in the code that does that. Very odd.

criterion9

WolfShade;1132197 wrote:
Thanks for the reply, Tcobb. Unfortunately, the cookie is being given a unique name, and the information is small enough that it isn't coming close to capacity for cookie value limit. And the weird thing is that if "hide all" is clicked, throwing all categories into hidden mode, it will remember that; but if you click on just one category "expand" link, the cookie is reset to default. There's nothing in the code that does that. Very odd.

^_

That sounds like it might be a logic bomb. Maybe post some code for us to take a gander.

Tcobb

One other thing occurred to me, but its pure speculation... Does your function that sets the cookie set and rely upon the optional cookie parameters 'domain' or 'path' ? If so, there could be a potential problem here, especially if no expiration date is set.

WolfShade

criterion9: I'll post some code in a bit.

Tcobb: The cookie does include ";path=/". I have since started adding an expiration date to switch from a session cookie to a physical cookie, with no noticeable difference.

WolfShade

I'm still waiting for my changes to be pushed from dev to staging, so if my last changes work this will be for nothing.

Here goes.. when the page first loads, there is no client selected so no data is displayed - no data, no categories, so nothing happens. Upon selecting a client from a drop down menu, there is an onChange event that (in addition to querying the database for client information) does the following:

onChange="document.cookie='vddstatus=\'\'; expires=Wed, 31 Dec 1980 23:59:11 UTC; path=/';"

It erases the cookie (expires it and sets it blank so the browser doesn't see it.)

When the page loads with data, a function is then automatically run:

function setDivState() {
	allNames = "";
	allDivs = document.getElementsByTagName('div');
	b=0;
	cookieValue = "vddstatus=";
	for(a=0;a<allDivs.length;a++) {
		if(allDivs[a].className == "input-table") { // Gets only divs that are expandable/collapsable
			if(b==0) {
				cookieValue += allDivs[a].id + ",1";
				}
			else {
				cookieValue += "|" + allDivs[a].id + ",1";
				}
			b++;
			}
		}
	cookieValue += "; expires=Sat, 31 Dec 2050 23:59:11 UTC; path=/";
//cookieValue looks like
// vddstatus=cat1,1|cat2,1|cat3,1.. cat9,1; expires=Sat, 31 Dec 2050 23:59:11 UTC; path=/";
// 1 means expanded, 0 means closed/hidden

cookieStart = 0;
if(document.cookie.length <= 0) { // No cookie			
	document.cookie = cookieValue;
	}
cookieStart = document.cookie.indexOf("vmpdetdivstatus=");
if(cookieStart == -1) { // There is a cookie, but it doesn't have what we need
	document.cookie = cookieValue;
	}
cookieStart = document.cookie.indexOf("vmpdetdivstatus=");

vmpStart = cookieStart + 16;
vmpEnd = document.cookie.indexOf(";",vmpStart);
if(vmpEnd == -1) { vmpEnd = document.cookie.length; }
vmpValue = unescape(document.cookie.substring(vmpStart,vmpEnd));
//alert(vmpValue);
stateArray = new Array();
stateArray = vmpValue.split("|");
saLength = stateArray.length;
for(i=0;i<saLength;i++) {
	nameState = stateArray[i].split(",");
	thisName = nameState[0]; thisState = nameState[1]; thisLink = document.getElementById(thisName+"-display");
	switch(thisState) {
		case "0":
			document.getElementById(thisName).style.display = "none";
			thisLink.innerHTML = "[expand]";
		break;
		default:
		break;
		}
	} 
}

If the cookie does not exist, set it to default all expanded. Regardless, read the cookie and set the category status to what is in the array.

Now for the hide/expand links. There is a "hide/expand one", a "hide all", and an "expand all". There is also a function for setting the cookie value accordingly.

Unfortunately, this post is running out of room, so I'll continue in the next reply.

(cont'd)

WolfShade

// This is the hide/expand one category
function toggleSectionDisplay(lnk, obj_id) {
	alterCurrentDivState(obj_id);
	obj = document.getElementById(obj_id);
	if(obj.style.display == 'none') {
		obj.style.display = '';
		lnk.innerHTML = '[hide]';
		}
	else {
		obj.style.display = 'none';
		lnk.innerHTML = '[expand]';
		}	
	return false;
	}

// This is the hide all
function hideSectionsDisplay(){
	var newCookieValue = cookieValue;
	newCookieValue = newCookieValue.replace(/\,1/gi, ",0"); // turn all opens into closes
	document.cookie = newCookieValue;
	obj_arr = AJS.getElementsByTagAndClassName(null,"input-table");
	lnk_arr = AJS.getElementsByTagAndClassName(null,"section_display");

for(var i=0; i<obj_arr.length; i++)
	obj_arr[i].style.display = 'none';

for(var i=0; i<lnk_arr.length; i++)
	lnk_arr[i].innerHTML = '[expand]';

return false;
}

// Here is the expand all
function expandSectionsDisplay(){
	document.cookie = cookieValue; //Sets cookie to expand all divs

obj_arr = AJS.getElementsByTagAndClassName(null,"input-table");
lnk_arr = AJS.getElementsByTagAndClassName(null,"section_display");

for(var i=0; i<obj_arr.length; i++) {
	obj_arr[i].style.display = ''; 
	}
for(var i=0; i<lnk_arr.length; i++) {
	lnk_arr[i].innerHTML = '[hide]';
	}
return false;
}

//Last but not least, here is what sets individual open/close settings in the cookie
function alterCurrentDivState(toggleThis) { // Change the state (0 or 1) of a div in cookie value
	if((document.cookie.length <= 0) || (document.cookie.indexOf("vddstatus=") < 0)) {
		document.cookie = cookieValue; alert("Category states undefined - reset to all categories expanded.");
		}
	var vmpCookieExists = document.cookie.indexOf("vddstatus=");
	var vmpCookieStart = vmpCookieExists + 16;
	var vmpCookieEnd = document.cookie.indexOf(";",vmpCookieStart);
	var vmpCookieValue = unescape(document.cookie.substring(vmpCookieStart,vmpCookieEnd));
	var thisArray = new Array(); 
	thisArray = vmpCookieValue.split("|"); 
	thisLength = thisArray.length;
	var newCookieValue = "vddstatus=";
	var thisDivState, thisId, thisState;
	for(a=0;a<thisLength;a++) {
		thisDivState = thisArray[a].split(","); thisId = thisDivState[0]; thisState = thisDivState[1];
		if(toggleThis == thisId) {
			switch(thisState) {
				case "1": thisArray[a] = thisId + ",0"; break;
				case "0": thisArray[a] = thisId + ",1"; break;
				}
			}
		switch(a) {
			case 0: newCookieValue += thisArray[a]; break;
			default: newCookieValue += "|" + thisArray[a];  break;
			}
		}
	newCookieValue += "; expires=Sat, 31 Dec 2050 23:59:11 UTC; path=/";
	document.cookie = newCookieValue; //alert(document.cookie);
	}

There could be a logic bomb in there.. I tried to be as careful as I could. If you see something, please LMK.

Thanks,

WolfShade

Anyone see anything in the code that might cause the cookie to set the value to a TLID or CFID? I think, now, that is what is happening.

Tcobb

Maybe I'm missing something here but I don't see where you are escaping all of the data before you write the cookie. In the function setDivState() there is the line:

cookieValue += "; expires=Sat, 31 Dec 2050 23:59:11 UTC; path=/";

I know that spaces are not allowed within the data that the cookie is storing. Are they allowed within the parameter sections?

WolfShade

I can only assume that it's okay. When I first Googled "javascript cookies", the tutorial that I looked at had it that way.

Tcobb

I can only assume that it's okay. When I first Googled "javascript cookies", the tutorial that I looked at had it that way.

Yeah--you're right. But looking at your code again, I noticed this:

//cookieValue looks like
// vddstatus=cat1,1|cat2,1|cat3,1.. cat9,1; expires=Sat, 31 Dec 2050 23:59:11 UTC; path=/";

The value has commas in it which are, as far as I can see, not escaped in the setDivState() function, and commas are not allowed within the value portion of the cookie string.

WolfShade

Tcobb;1132403 wrote:
The value has commas in it which are, as far as I can see, not escaped in the setDivState() function, and commas are not allowed within the value portion of the cookie string.

I'll Google that; but even if that did explain why it's not working in staging, why does it work in development? That's the thing that really has me scratching my head.. it works in development but not in staging (and, theoretically, it won't work in production, either.)

WolfShade

This is very frustrating.

On development, it is working with no problems, whatsoever.

On staging (as it probably will on production), here is what it's doing:

If "expand all" is clicked, this is the cookie value:

vddstatus
cat1,1|cat2,1|cat3,1|cat4,1|cat5,1|cat6,1|cat7,1|cat8,1|cat9,1
domain.com/
1088
1060073856
33063389
2884050624
30125481

If "hide all" is clicked, this is the cookie value:

vddstatus
cat1,0|cat2,0|cat3,0|cat4,0|cat5,0|cat6,0|cat7,0|cat8,0|cat9,0
domain.com/
1088
1060073856
33063389
2884050624
30125481

If any individual "hide" or "expand" is clicked, this is the cookie value:

vddstatus
[color=red]TLTUID=29A2C6BA180E1018889AF39A9D19E869[/color]
domain.com/
1088
1060073856
33063389
[color=red]1613223328
30125482[/color]

Not only can I not see what is causing this to happen, but the fact that it is NOT doing this in development is really driving me up a wall. It's the same code on both servers.

Any ideas?

nsaxena76

hi did you find the solution to this issue ? if yes, can you please share.

root

Stop wasting your time with cookies.

Use localStorage and localSession objects where possible and only rely on cookies as a last resort.

Theres many advantages over the use of localStorage, one being data size, another is persistence and privacy.

Train

01-06-2011, old thread
Closing