CSRF problem

[storm9c1]

Email sent. Thanks!!!

[hansfn]

Thx for the access. It enabled me to debug it.

The problem was a bug in the cookie domain detection code in PivotX - ref http://sourceforge.net/p/pivot-weblog/code/4343 For any domain in the form "wwwX.example.org" (where X is any character), the bug caused PivotX to try to set the session cookie on the domain "..example.org". Notice the extra dot?

[storm9c1]

Yes, thanks for taking the time to debug it! Very much appreciated! I owe you a beer.........

I wonder what would happen if the webserver was called "something.domain.com" instead of "www.domain.com" -- would that cause any problems? If so, then that should be mentioned here just in case someone reading runs into that edge case. (then again only if I am truly understanding the problem...)

[hansfn]

What the code does is to handle the very, very common case that www.example.org and example.org is the same site. Without the code the following could happen:

1) Log in at www.example.org/pivotx.
2) Move around and end up at example.org
3) Going to example.org/pivotx you would be asked to log in again since the login (the session cookie to be precise) in step 1 is only valid for the www subdomain.

In other words (after the bug fix), only subdomains named "www" (like www.example.org) gets this special treatment.

PS! A cookie is valid on the domain it is set and all subdomains of that domain.