[Solution] Login Cookie Problem Solution - server-based

[promil]

This is NOT a client-based solution. This is a server-based solution!

(you can't expect to let all your board visitors change their IE settings.)

Let me guess, the cookie problem comes up with IE6.
That was exactly my problem. (I need cookies because I use Frames)
IE6 doesn't accept any "3rd party" cookie provider.

It's typical for MS to plug in any new standards (security) and don't think about the user who gets problems with this. This new secuity standard is P3P.

(http://www.w3.org/P3P/)

This is a small tip I can give you. It works fine for me. It makes it possible to use "3rd party" cookies with IE


1. go into the directory "includes".

2. search for the file "sessions.php" and edit it

3. search for the text

setcookie($cookiename . '_data',

(it schould be 3 times within this file.)

4. now, set this text in front of No. 3:

header('P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"');

5. you schould have done No. 4 exactly 3 times.

==================

This is a small sample:

header('P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"');
setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
setcookie($cookiename . '_sid', $session_id, 0, $cookiepath, $cookiedomain, $cookiesecure);

I hope I've not written this too confusing. (I'm a german guy)

PS: now I'm using phpBB 2.0.3 (BUT it schould also work for 2.0.4)

I already got some positiv feedback (also for 2.0.4) How does it work for you?

promil

(my 1st post )

[ionsurge]

That seems clear enough.

I'll give it a whirl now.

btw is this for framed-phpbb's only, cos if it is, then I don't need to make changes...

[promil]

NO, this is NOT only for framed-phpBB's!!! It schould also work for NONE-framed phpBB's

This is for all.

especially for people who have their webspace on a different provider than their domain is.

Example:

my domain is at: http://kickme.to/xxxxxxxxxxx
and my webspace: www.tripod.de (you have a totally different provider than your domain) - webspace would be "3rd party" cookie provider then

(now they should have some problems with IE6)
With the discriped solution this shouldn't be a problem any more.

PS: But I'm not sure about this domain-webspace-provider thing.

[ionsurge]

Okay, that is all I needed, installation ahoi!

[ionsurge]

Done. Now, time to wait...

[Crush0r]

well, n1 n1...

but it doesn't work
...or must i change my settings?

Code: Select all

cookie domain: scheinwerfer-ploen.de
cookie name: phpbb2mysql
cookie path: /
cookie secure: no
session length: 3600


PS: kannst mir auch auf deutsch antworten

[promil]

This is only for the IE6 (3rd party) cookie problem. (if you use short-urls or other redirects.)
Only if you are sure that you set up phpBB (incl. the cookie settings) right!


but for you try:

cookie domain: www.scheinwerfer-ploen.de

or

cookie domain: .scheinwerfer-ploen.de {with 2x "."}

or

cookie domain: {leave it blank}

[cosmos]

This is only for the IE6 (3rd party) cookie problem. (if you use short-urls or other redirects.)
Only if you are sure that you set up phpBB (incl. the cookie settings) right!


but for you try:

cookie domain: www.scheinwerfer-ploen.de

Incorrect! Avoid this at all costs. Cookie specs indicate that if a cookie domain is set to something that does not start with a dot, then a dot is prepended. Therefore, by setting "Domain name" with phpBB to www.scheinwerfer-ploen.de, you are effectively setting the domain cookie property for all cookies generated to .www.scheinwerfer-ploen.de (notice the starting dot). This is wrong!

or

cookie domain: .scheinwerfer-ploen.de {with 2x "."}

Not a bad thing to do if you have other hosts in the same domain with which you'd like to share cookies. This is not the usual case.

or

cookie domain: {leave it blank}

This is the recommended setting IMO. Effectively leaves the cookie domain field empty, therefore all browsers are required to interpret this as cookies should be sent if an exact host (as opposed to domain) match exists.

Hope that helps.-

Edit: @Promil, would you be so kind and "translate" (or offer any links for on-line tools that do the job) the P3P policy you've presented?