When logging into Drupal for the first time, using a basic HTTP request, the response to the login POST returns *two* Set-Cookie headers. The first one contains an invalid session ID and the second one (in the order in which they appear in the POST response) contains the valid one.

This can be experienced by doing the following:

curl -v -d "name=USERNAME&pass=PASSWORD&form_id=user_login" http://drupal.example.com/user/login

You should see the two "Set-Cookie" headers in the 302 success response.

Most browsers simply ignore the first one and set the second one properly, but unfortunately I have a confused HTTP client library that does it in reverse.

I've tried this with a number of different Drupal servers and I don't suspect that it is related to the domain. I more suspect it's related to PHP or the way Drupal interacts with PHP's sessions.

Comments

xxvelcrar’s picture

xxvelcrar commented

Here's what the HTTP response headers look like.

 HTTP/1.1 302 Found
 Date: Mon, 12 Nov 2007 20:12:52 GMT
 Server: Apache/2.2.3 (Debian) PHP/5.2.0-8+etch7 mod_perl/2.0.2 Perl/v5.8.8
 X-Powered-By: PHP/5.2.0-8+etch7
 Set-Cookie: SESScaae81990d7e31732997b2f5795e9ba4=dcfe6080292b20645eada29c22f92549; expires=Wed, 05 Dec 2007 23:46:12 GMT; path=/; domain=.drupal.example.com
 Expires: Sun, 19 Nov 1978 05:00:00 GMT
 Last-Modified: Mon, 12 Nov 2007 20:12:52 GMT
 Cache-Control: store, no-cache, must-revalidate
 Cache-Control: post-check=0, pre-check=0
 Set-Cookie: SESScaae81990d7e31732997b2f5795e9ba4=2ee9df522bc30c4dc2c9a251132694c4; expires=Wed, 05 Dec 2007 23:46:12 GMT; path=/; domain=.drupal.example.com

The first Set-Cookie header is invalid. If you attempt to load a page using it, you get a 403

dpearcefl’s picture

dpearcefl commented
Status: Active » Closed (won't fix)

Due to the age of the last comment on this issue and due to the fact that D5 is no longer supported, I am closing this issue.