cfcookie not working (CF9)

[plarts]

I use this line of CF code to set new cookies :

<cfcookie name="PLARTS_MAIL_USERNAME" value="#trim(form.username)#" expires="410">

And i cannot see my cookie in FireFox , or readding it with Javascript,

or using CF read with : <cfparam name="cookie.PLARTS_MAIL_USERNAME" type="string" default="" />

It always return "blanc" , not existing.

(I can see other cookies from other Sites).

Any idea ? any help thanks.

[insuractive]

What happens if you dump out your COOKIE scope immediately after setting it?

<cfcookie name="PLARTS_MAIL_USERNAME" value="#trim(form.username)#" expires="410">
<cfdump var="#COOKIE#">

Also, you're not doing a <cflocation> on the same page that you are setting your cookie are you?

[plarts]

Thanks for this view with Dump.

I did a small program to set cookies and read them, it does work.

But inside my application , it does not work, no cookies are created.

So I think I have to look deeply in the apllication, why it does does not work.

[insuractive]

There are typically 2 common reasons why cookies do not get set in CF applications:

1. The developer is trying to set a cookie and then performs a cflocation redirect.  In this case, the redirect command is sent to the browser and the browser never receives the cookie set command
2. The user's browser rejects the cookie due to security/privacy issues.  Typically you will see this if the site is missing a P3P privacy policy - many modern browsers reject cookies outright from sites that don't declare their intentions on how they want to use the data.

[plarts]

My understanding is now :

If the cookies are set with a CFINCLUDE of the file doing the cookies,

it does not work.

If the cookies are set inside the primary file, it does work.

Can you understand this ?

[insuractive]

I think we'd have to see some sample code in order to offer any additional suggestions at this point.

[plarts]

Well, very strange behaviour.

I will look more deeply in all of this, because I have very strange behaviour.

When doing a <cfcookie name expires="now"

the cookie is SET and empty.

When I do a <cfcookie name value expires=10> , the cookie is not SET, and more than that , they have desappeared.

(same cookies which have been created before with expires="now")

So, I need to look more deeply and come back with the diagnostic.

But in the outside programs to understand,

the command <cfcookie name expires="now">

create an empty cookie.

[Dave Watts]

There are typically 2 common reasons why cookies do not get set in CF applications:

1. The developer is trying to set a cookie and then performs a cflocation redirect.  In this case, the redirect command is sent to the browser and the browser never receives the cookie set command

This has not been true in CF for quite some time. Modern versions of CF can set a cookie and a redirect header in the same HTTP response. Also, this was a limitation in earlier versions of CF, rather than a browser limitation.

Dave Watts, CTO, Fig Leaf Software

[BKBK]

plarts wrote:

I use this line of CF code to set new cookies :

<cfcookie name="PLARTS_MAIL_USERNAME" value="#trim(form.username)#" expires="410">

And i cannot see my cookie in FireFox , or readding it with Javascript,

or using CF read with : <cfparam name="cookie.PLARTS_MAIL_USERNAME" type="string" default="" />

It always return "blanc" , not existing.

(I can see other cookies from other Sites).

Two points:

1) If your application file is Application.cfm, then give the attribute setClientCookies (in the cfapplication tag) the value "yes". If you're using Application.cfc instead, then give this.setClientCookies the value "yes".

2) I created the following 2 CFM pages, and ran testPage.cfm. It works!

cookiePage.cfm

<cfcookie name="bkbk" value="testing testing 1, 2, 3" expires="10">

testPage.cfm

<cfinclude template="cookiePage.cfm">

<cfdump var="#cookie#">

[plarts]

I fully agree with what you did.

outside my application, all is working well. (small testing)

Inside my application, not.

But it is simple, there is a form for LOGIN.

When submitted, I create the cookies, works well, I can see my cookies.

If I refresh the page, (so resubmit, which is the same process) the cookies are lost.

I mean, I cannot see them anymore.

If I go to another page after the Login, same, the cookies are lost.

And there is nowhere expires='now' for these cookies.

OK, I give up. I keep it like this, no cookies for the LOGIN. (I only use the session variable to remember)

In same application, I use another cookie elsewhere, all is working fine.

[BKBK]

plarts wrote:

...

outside my application, all is working well. (small testing)

Inside my application, not.

...

In same application, I use another cookie elsewhere, all is working fine.

It is confusing what you describe as "inside" and "outside" of your application. Could you please explain how you tell the difference. It might be that one part of your code is setting the cookie, whereas another is deleting it.

[plarts]

Outside the application, means individual programs for testing, working well.

Inside the application, means among more complex programs, where cookies are deleted after having been created

when going to another page. And no command for deleting these Cookies exist.

So I am still trying to understand.

As soon as I have found a potencial reason, I will come back on this topic.

Thanks for your cooperation.

Pierre.

[BKBK]

plarts wrote:

Outside the application, means individual programs for testing, working well.

Inside the application, means among more complex programs, where cookies are deleted after having been created

when going to another page. And no command for deleting these Cookies exist.

I see now. I will recommend that you create a session variable right after setting the cookie, for example,

<cfset session.testVar = "Session test">

Then test (at the same page where you test for cookies) to see whether the session variable is disappearing as well.

[plarts]

At same time, same page, some session variables are set,

but they do not desappear.

[BKBK]

plarts wrote:

At same time, same page, some session variables are set,

but they do not desappear.

Your application therefore maintains session from one page to the next. That could only have happened because the session cookies CFID and CFToken were not deleted. So we know at least some cookies survive.

To return to the beginning, what are you using to view the cookies? As Insuractive rightly said, a browser can, for whatever reason, exclude cookies. So your problem could very well be caused by the browser. What's the browser type?

To rule this out as a ColdFusion problem, we will have to return to another of Insuractive's suggestions: cfdump. On the page where you create the cookies, using your cfset statement, add <cfdump var="#cookie#"> afterwards. Remove the cfparam line.

On every page that you wish to test, add: <cfdump var="#cookie#">.

What do the dumps reveal?

[plarts]

Well, I tried this,

With IE8 , at next page , the login cookies are lost.

an other cookie for something else is kept. (still alive)

Close/Open the browser, the other cookie is still there.

With FireFox V8,

at next page the login cookies are lost, the other is still alive.

Close/Open the brower, the other cookie is lost. (all lost)

(except : CFID, CFTOKEN, CFGLOBALS)

i do not know what is CFGLOBALS ?

This on 2 different PC, same behaviour.

(I used CFDUMP to see them)

I do not understand. Thanks for any idea.

[BKBK]

plarts wrote:

(except : CFID, CFTOKEN, CFGLOBALS)

i do not know what is CFGLOBALS ?

That means you have enabled the use of client variables and have instructed ColdFusion to store client variables as cookies. ColdFusion would then create the cookies CFID, CFToken and CFGlobals. CFGlobals stores the following global data about the client: HitCount, TimeCreated and LastVisit.

plarts wrote:

Well, I tried this,

With IE8 , at next page , the login cookies are lost.

an other cookie for something else is kept. (still alive)

Close/Open the browser, the other cookie is still there.

With FireFox V8,

at next page the login cookies are lost, the other is still alive.

Close/Open the brower, the other cookie is lost. (all lost)

This suggests that your code likely does a cflocation in the same request that creates the login cookie. Insuractive and Dave Watts have mentioned this, too. One more evidence of cflocation is the fact that your cookie code uses a form-variable. This implies that the cookie tag is in the form's action page, before redirection (assuming, of course, there is a redirection).

Check your code for cflocation. The logical place to find it: just after the login validation.

[BKBK]

Assume, following my last post, that cflocation is indeed the cause. Then it requires just a minor change to fix the issue. Something like this

<!--- Login processing and validation. --->

<!--- Set flag isLoginSuccessful to false, by default. If login succeeds, set it to true --->

...

...

<cfset session.username = "">

<cfif isLoginSuccessful>

    <cfset session.username = trim(form.username)>

    <cflocation url="loginSuccess.cfm">

</cfif>

<!--- code to handle case where login failed --->

...

...

etc., etc.

loginSuccess.cfm

<cfif isDefined("session.username") and session.username is not "">

   <!--- set 28-day cookie --->

    <cfcookie name="PLARTS_MAIL_USERNAME" value="#session.username#" expires="28">

</cfif>

[plarts]

I do not use any CFLOCATION anywhere.

When coming into the application, there is a page run in an Iframe,

reading the existing cookies via a javascript.

If cookies are found , this rebuild all session variables for the login.

So no need to relog (if on same PC).

But as the cookies are lost the relog is needed (via a form)  at each reboot of the PC.

(session variables are reset, login is OK)

I have folowed the cookies life.

They first are set as demanded in first page, after success of login.

Fist page is a listing of received mails. (via a cfpop)

If I refresh that page, cookies are lost (seen with cfdump).

[BKBK]

Ah, IFrames. This immediately got me thinking about the third-party-cookie problem. What happens when you add the following header to Application.cfm (or alternatively to the onRequeststart method of Application.cfc)?

<cfheader name="P3P" value="CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'">

[plarts]

I add this line in "application.cfm"

same behaviour.

[BKBK]

Incidentally, rename the file Application.cfm

[plarts]

When I do the same thing with simple pages, it works and cookies are kept.

one page set up cookies, then go to another page, and I still have the cookies.

In same directory, so with same application.cfm.

So, I take out piece and piece of codes in the real application and see when the cookies are lost.

Then I found it :  a CFFLUSH

I have a <cfflush interval=10>

with it, I loose the cookies, if I take it out

I keep the cookies.

Why, I do not know.

Any suggestion ?

[insuractive]

Documentation for <cfflush>:

http://livedocs.adobe.com/coldfusion/8/htmldocs/help.html?content=Tags_f_12.html

Using cfflush prevents any cokies from being set. Makes sense since you are flushing content (including header content) to the browser in a way that probably interferres with normal cookie setting.

[plarts]

Thanks, the documentation is right.

That is the problem.

I never look deeply in the cfflush doc.

So now, I know that I need to take care a lot with that tag.

Thanks for cooperation.

Pierre.