New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 596429 link

Starred by 6 users

Issue metadata

Status: WontFix
Owner:
Buried. Ping if important.
Closed: Oct 4
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug



Sign in to add a comment

Http Request set duplicate cookies with different values

Reported by groo...@gmail.com, Mar 21 2016

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2686.0 Safari/537.36

Example URL:
http://localhost:8000

Steps to reproduce the problem:
1. perform an http GET request sending some cookies
2. the response should contains certain cookies depending on server logic
3. 

What is the expected behavior?
Normal session-based authentication, or in general user tracking based on cookies.

What went wrong?
Sometimes (not always) the browser sets some request cookies twice. Both these 2 cookies have the same identifier but different values. I could notice that the second values seems to be an old cookie value that was set (and then removed) a while ago. In a way the browser still remembers its value.

This creates big problem for the backend not able to identify the correct cookie with certainty. 

Did this work before? Yes It seems until the latest update (not really sure)

Chrome version: 51.0.2686.0  Channel: canary
OS Version: OS X 10.9.5
Flash Version: Shockwave Flash 21.0 r0

I am developing a web app in angular and to be sure it is not a bug on my side I have tested this with chrome stable, firefox and Safari, they all work correctly.

I've also reverted my change to a point when I was sure everything worked correctly and this bug still happens (it did not surely happen before).

Also this bug does NOT happen when I browse in incognito mode.

It seems that this does NOT happens always BUT in my local app this DOES always happen for a certain url that ahs the form: 

http://localhost:8000/app/whatever?param=value1&param=value2&param=value3&param=value4&page=1&start=0&limit=25&period=undefined
 
Could you provide a net-internals dump? Instructions here: https://sites.google.com/a/chromium.org/dev/for-testers/providing-network-details
Hello, the dump include personal cookies, how can I safely share it with you?
Labels: Needs-Feedback
Are you using your test app at localhost:8000? Could you use a fake test account whose cookies don't matter?
Hello again, 
I've looked into the dump and there are also other sensitive data like to google  cookies and other information I'd rather not to share publicly. Is there any way I could send you a private email?
Btw I could see the duplicated cookie in the dump
I see. You can send it to my email: xunjieli@chromium.org.
Cc: mmenke@chromium.org
Components: -Internals>Network Internals>Network>Cookies
Labels: -Needs-Feedback
Attaching Internals>Network>Cookies label.
In the netlog dump, the first 5 requests to localhost do not have duplicated cookies. The 6th request sends one additional set of cookies (sessionid, csrftoken, etc) in additional to what the first 5 requests were sending.

leonard.gentitle@: since this is a recent regression, is it possible to launch your test app somewhere, so I can reproduce and do a bisect? Or if you prefer to keep it confidential, you can do a bisect. Instructions here: http://dev.chromium.org/developers/bisect-builds-py 

Comment 7 by mmenke@chromium.org, Mar 22 2016

Cc: jww@chromium.org mkwst@chromium.org
[+mkwst, +jww]

Comment 8 by mkwst@chromium.org, Mar 23 2016

Cc: -mkwst@chromium.org
Owner: mkwst@chromium.org
Status: Assigned (was: Unconfirmed)
Are they actually distinct cookies? That is, do they have distinct paths or domains?

xunjieli@: Could you share the dump with me?
mkwst@: The reporter did a local bisect, but he didn't get the commit range.
He tried "python bisect-builds.py -a mac -g 378081 -b 382459 --use-local-cache", and could not reproduce the bug. He got the message: 
You are probably looking for a change made after 382449 (known good), but no later than 382459 (first known bad). He thinks the regression might be around 382459. 

I will share it with you once I get a confirmation from him.

Comment 10 by mmenke@google.com, Mar 23 2016

51.0.2686.0 maps to 382218, which does not include revisions around 382459, so presumably that range is incorrect.
mkwst@: I have shared with you the net-internals dump through email.

My bad, I ran the bisect again with:

python bisect-builds.py -a mac -g 378081 -b 382218 --use-local-cache --user-data-dir=/path/to/user/dir

And I got again the same "You are probably looking for a change made after 382217 (known good), but no later than 382218 (first known bad)."

I have used the same User folder of the profile causing the problem. I just want to highlight again: in the version causing the issue (51.0.2686.0) the problem is reproducible only with the specified user profile (synced with google account). If I change user profile or I chose incognito mode then I cannot reproduce the issue.

I did disabled (not removed) all the extensions, could it be that they could still create troubles?
Just checking, is there any update on this? This is still happening on 52.0.2715.0 canary (64-bit) Mac Osx 10.9.5
52.0.2730.0 canary (64-bit), still happening, could please someone gives an update on this? If this lands in stable will break many applications

Comment 15 by groo...@gmail.com, Nov 4 2016

For a while this problem went away, I'm not sure why but today it's back, on Mac Version 56.0.2908.0 canary (64-bit). See the attached file for an example of a request setting duplicate cookies.

Could someone gives me an update on this? This is breaking my application, because it sets old expired cookies and the users will be logged out each time even if they have valid cookies!!



duplicate_cookies.txt
999 bytes View Download
Could you go to the page that gets double cookies in chrome, click on the icon on the left of Chrome's address bar, click the "cookies" button, and see if two cookies with the same name are set on different paths/domains?
no, just one set of cookies. But once( I can't reproduce it) I've seen two set of cookies (duplicated) on the same path, but I can't be 100% sure until I could reproduce this.
We are experiencing this issue on the latest live chrome browser, the request to our servers have duplicate cookies causing outages.
NVM they have different paths
Status: WontFix (was: Assigned)
Closing as per #19. This seems to be WAI.

Sign in to add a comment