Cookie with expiry time not saved when system date changes to past date
Reported by
riyazpan...@gmail.com,
Apr 23 2016
|
||||||
Issue description
<b>Chrome Version : <Copy from: 'about:version'></b>
URLs (if applicable) :
Other browsers tested:
Add OK or FAIL after other browsers where you have tested this issue:
Firefox: PASS (45.0.2)
IE: PASS (Microsoft Edge)
What steps will reproduce the problem?
(1) Change system date to past date.
(2) Set cookie with 30 minutes expiry time.
(3) Observe the cookie in resource section of chromium debugger tool.
What is the expected result?
-> cookie should be saved
What happens instead?
-> cookie not saved
Please provide any additional information below. Attach a screenshot if
possible.
,
Apr 26 2016
But other browsers support this handling.
,
Apr 26 2016
Thank you for providing more feedback. Adding requester "eroman@chromium.org" for another review and adding "Needs-Review" label for tracking. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Apr 26 2016
Other browsers supporting it doesn't necessarily make that the correct behavior. Please provide an example and I can review. Adjusting for time skew fixes a different class of issues. And if your clock is too far off even HTTPS will stop working.
,
Apr 26 2016
Adding the label Needs-feedback as per # 4
,
Apr 28 2016
Too far means how much time. I have checked one site where changes the system date to 1st november 2015 then page is loaded but google-analytics library not loaded. On this website there are two https calls which is working fine on changing the date to 1/11/2015 but https://www.google-analytics.com/analytics.js library not loaded. Please comment on this.
,
Apr 28 2016
Thank you for providing more feedback. Adding "Needs-Review" label for tracking. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
May 2 2016
RE comment #6 -- analytics.js is served with a certificate that is not valid before April 27, 2016, so it will not work if your date is Nov 2015.
,
May 3 2016
But my https call are working fine even if system date is set to past date. As per your old comment, these should be stop working.
,
May 3 2016
@riyazpanarwala: I don't follow. Are you saying that you *can* load https://www.google-analytics.com/analytics.js when your clock is set to 2015? You shouldn't be able to, as we expect that to fail with ERR_CERT_DATE_INVALID. Either way the original bug is still a won't fix as noticing clock skew between client and server when setting cookies is intentional. Do you have a use-case or example for why you think that should work? |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by eroman@chromium.org
, Apr 25 2016Labels: Needs-Feedback