Hi, I just upgraded this morning a Debian Woody server with Zope 2.5. The upgrade has resulted in all my CMF (which use SiteRoot or VirtualHostMonster) to refuse any authentication. Without SiteRoot or VirtualHostMonster, everything is fine. I am searching the reason. JPS.
I just upgraded this morning a Debian Woody server with Zope 2.5. The upgrade has resulted in all my CMF (which use SiteRoot or VirtualHostMonster) to refuse any authentication.
Without SiteRoot or VirtualHostMonster, everything is fine.
I have had this problem (and a few others, some fixed in CVS) with VHM for some time now. Everything is fine on 8080, but fails using VHM. Since noone else experienced it, I thougt that it was something local here... /Magnus
Le Mardi 5 Mars 2002 15:15, vous avez écrit :
I just upgraded this morning a Debian Woody server with Zope 2.5. The upgrade has resulted in all my CMF (which use SiteRoot or VirtualHostMonster) to refuse any authentication.
Without SiteRoot or VirtualHostMonster, everything is fine.
I have had this problem (and a few others, some fixed in CVS) with VHM for some time now. Everything is fine on 8080, but fails using VHM.
Since noone else experienced it, I thougt that it was something local here...
/Magnus
I moved everything from SiteRoot to VHM. It does not change anything. Standard sites are OK in terms of authentication. CMF sites fail. I have the impression something wrong happens in the portal_membership tool. JPS.
Here are the news - whener the CMF is access through a VHM, only one cookie is set (__ac_name) and we get a loop on the login page - whenever the CMF is accessed directly (in my case through an ssh tunnel pointing to the root of the zope) two cookies are set (__ac=anA6YXRhbGFu%0A and __ac_name) More to follow. JPS. (sorry for being so slow, I am sick and had to go to the doctor). -- Jean-Paul Smets-Solanes <jp@nexedi.com> - Nexedi (CEO) GPG Fingerprint: 40FF FA78 75AA 680D 8BB4 EEF9 539A 79CC CB8E 5F01
I started debugging Zope. I found that the various methods in CookieCrumbler are called and should normally set a cookie for auth_cookie. However, under VHM operation, this does not happen when auth_cookie == '__ac' I changed the name of the authentication cookie to __ac_erp5 in the CMF (www.erp5.org is the site I am working on). Everything works fine now. I have absolutely no idea what it can mean. As a reminder, I had no problems for 6 months and suddenly, after a small upgrade, all this strange behaviour started. JPS. -- Jean-Paul Smets-Solanes <jp@nexedi.com> - Nexedi (CEO) GPG Fingerprint: 40FF FA78 75AA 680D 8BB4 EEF9 539A 79CC CB8E 5F01
I could find out that certain cookie names work, some others do not Works __ac_ __ac_ra __ac_rak1 __ac_nex1 __ac_erp5 Does not work __ac __ac_rack1 __ac_rack12 Really strange. JPS. -- Jean-Paul Smets-Solanes <jp@nexedi.com> - Nexedi (CEO) GPG Fingerprint: 40FF FA78 75AA 680D 8BB4 EEF9 539A 79CC CB8E 5F01
Jean-Paul Smets wrote:
I could find out that certain cookie names work, some others do not
Works
__ac_ __ac_ra __ac_rak1 __ac_nex1 __ac_erp5
Does not work
__ac __ac_rack1 __ac_rack12
Really strange.
What browser are you using? Strange things like this happen for me occasionally after a Mozilla upgrade, but I just delete the cookies for the site and everything goes back to normal. I figure someone at Netscape is just fiddling with the cookie code. :-) OTOH, the only way a loop on the login page can happen is if you're not allowed to access the login page, or perhaps one of its images. Maybe something is caching authentication in a non-thread-safe way. In fact, the last hotfix addressed something like this, didn't it? Shane
Jean-Paul Smets wrote:
I could find out that certain cookie names work, some others do not
Works
__ac_ __ac_ra __ac_rak1 __ac_nex1 __ac_erp5
Does not work
__ac __ac_rack1 __ac_rack12
Really strange.
What browser are you using? Strange things like this happen for me occasionally after a Mozilla upgrade, but I just delete the cookies for the site and everything goes back to normal. I figure someone at Netscape is just fiddling with the cookie code. :-)
I'm using IE6. It isn't just this one. http://collector.zope.org/Zope/251 and http://collector.zope.org/Zope/260 also does different things when using VHM. /Magnus
On Thu, 7 Mar 2002, Magnus Heino wrote:
What browser are you using? Strange things like this happen for me occasionally after a Mozilla upgrade, but I just delete the cookies for the site and everything goes back to normal. I figure someone at Netscape is just fiddling with the cookie code. :-)
I'm using IE6.
It isn't just this one. http://collector.zope.org/Zope/251 and http://collector.zope.org/Zope/260 also does different things when using VHM.
It would be helpful if you would run tcpwatch and figure out exactly what interaction is happening between Zope and the browser. Just use "tcpwatch -p 3128" and set localhost:3128 as your proxy server. http://hathaway.freezope.org/Software/TCPWatch Then delete all the stored cookies for your site and see if the problem disappears. Shane
Jean-Paul Smets writes:
I could find out that certain cookie names work, some others do not
Works .... Really strange. Could you use "tcpwatch" (or another TCP logger) to see whether the Zope response contains the cookie header. If not, this would be a Zope problem we could debug. If so, we have to look elsewhere.
Dieter
Le Mercredi 6 Mars 2002 22:35, Dieter Maurer a écrit :
Jean-Paul Smets writes:
I could find out that certain cookie names work, some others do not
Works .... Really strange.
Could you use "tcpwatch" (or another TCP logger) to see whether the Zope response contains the cookie header. If not, this would be a Zope problem we could debug. If so, we have to look elsewhere.
Here is the information. 5 cases are shown - Use of Apache + RewriteRule + VHM (CMF auth. cookie is __ac_erp5) - Use of Apache + RewriteRule + VHM (CMF auth. cookie is __ac) - Use of Medusa (CMF auth. cookie is __ac) - Use of Apache + RewriteRule w/o VHM (CMF auth. cookie is __ac_erp5) - Use of Apache + RewriteRule w/o VHM (CMF auth. cookie is __ac) The scenario is - go to http://www.erp5.org/login_form - look at what happens with tcpdump after filing the form and posting it In all cases, this leads to a login success. However, if the auth. cookie is not set (which happens in cases where Apache is used and aut. cookie is __ac), then we are in trouble... You will see that the Set-Cookie is different in the 5 cases My conclusion for now is that something could be wrong with the Apache rewriting process. Regards, JPS. Apache VHM Config <VirtualHost erp5.org> DocumentRoot /home/jp/public_html/erp5/ ServerName erp5.org ServerAlias www.erp5.org RewriteEngine On RewriteRule ^/(.*) http://localhost:9673/VirtualHostBase/http/www.erp5.org:80/erp5/VirtualHostR... [L,P] #RewriteRule ^/(.*) http://localhost:9673/erp5/$1 [L,P] </VirtualHost> __ac_erp5 + Apache + VHM 0x0000 4500 05dc 03cb 4000 3306 bbb5 d42b ed44 E.....@.3....+.D 0x0010 c0a8 0083 0050 9843 a89d dbe3 a856 a8fb .....P.C.....V.. 0x0020 8010 1b00 1eda 0000 0101 080a 0212 d894 ................ 0x0030 01f9 4691 4854 5450 2f31 2e31 2032 3030 ..F.HTTP/1.1.200 0x0040 204f 4b0d 0a44 6174 653a 2053 6174 2c20 .OK..Date:.Sat,. 0x0050 3039 204d 6172 2032 3030 3220 3133 3a33 09.Mar.2002.13:3 0x0060 353a 3533 2047 4d54 0d0a 5365 7276 6572 5:53.GMT..Server 0x0070 3a20 4170 6163 6865 2f31 2e33 2e32 3320 :.Apache/1.3.23. 0x0080 2855 6e69 7829 2044 6562 6961 6e20 474e (Unix).Debian.GN 0x0090 552f 4c69 6e75 780d 0a43 6f6e 7465 6e74 U/Linux..Content 0x00a0 2d4c 656e 6774 683a 2035 3734 340d 0a43 -Length:.5744..C 0x00b0 6f6e 7465 6e74 2d54 7970 653a 2074 6578 ontent-Type:.tex 0x00c0 742f 6874 6d6c 0d0a 4574 6167 3a20 0d0a t/html..Etag:... 0x00d0 5365 742d 436f 6f6b 6965 3a20 5f5f 6163 Set-Cookie:.__ac 0x00e0 5f65 7270 353d 2261 6e41 3659 5852 6862 _erp5="anA6YXRhb 0x00f0 4746 7525 3041 223b 2050 6174 683d 2f0d GFu%0A";.Path=/. 0x0100 0a58 2d43 6163 6865 3a20 4d49 5353 2066 .X-Cache:.MISS.f 0x0110 726f 6d20 6572 7035 2e6f 7267 0d0a 4b65 rom.erp5.org..Ke 0x0120 6570 2d41 6c69 7665 3a20 7469 6d65 6f75 ep-Alive:.timeou 0x0130 743d 3135 2c20 6d61 783d 3130 300d 0a43 t=15,.max=100..C 0x0140 6f6e 6e65 6374 696f 6e3a 204b 6565 702d onnection:.Keep- 0x0150 416c 6976 650d 0a0d 0a20 0a0a 3c68 746d Alive.......<htm 0x0160 6c3e 0a20 3c68 6561 643e 2020 0a20 203c l>..<head>.....< 0x0170 7469 746c 653e 4552 5035 2043 6f6d 6d75 title>ERP5.Commu 0x0180 6e69 7479 3a20 4552 5035 2043 6f6d 6d75 nity:.ERP5.Commu 0x0190 6e69 7479 3c2f 7469 746c 653e 0a20 203c nity</title>...< __ac + Apache + VHM 0x0000 4500 05dc 4d68 4000 3306 7218 d42b ed44 E...Mh@.3.r..+.D 0x0010 c0a8 0083 0050 9845 b6c0 6432 b5b6 2c45 .....P.E..d2..,E 0x0020 8010 1b00 53bb 0000 0101 080a 0213 29c6 ....S.........). 0x0030 01f9 97c1 4854 5450 2f31 2e31 2032 3030 ....HTTP/1.1.200 0x0040 204f 4b0d 0a44 6174 653a 2053 6174 2c20 .OK..Date:.Sat,. 0x0050 3039 204d 6172 2032 3030 3220 3133 3a33 09.Mar.2002.13:3 0x0060 393a 3231 2047 4d54 0d0a 5365 7276 6572 9:21.GMT..Server 0x0070 3a20 4170 6163 6865 2f31 2e33 2e32 3320 :.Apache/1.3.23. 0x0080 2855 6e69 7829 2044 6562 6961 6e20 474e (Unix).Debian.GN 0x0090 552f 4c69 6e75 780d 0a43 6f6e 7465 6e74 U/Linux..Content 0x00a0 2d4c 656e 6774 683a 2035 3734 340d 0a43 -Length:.5744..C 0x00b0 6f6e 7465 6e74 2d54 7970 653a 2074 6578 ontent-Type:.tex 0x00c0 742f 6874 6d6c 0d0a 4574 6167 3a20 0d0a t/html..Etag:... 0x00d0 5365 742d 436f 6f6b 6965 3a20 5f5f 6163 Set-Cookie:.__ac 0x00e0 5f6e 616d 653d 226a 7022 3b20 4578 7069 _name="jp";.Expi 0x00f0 7265 733d 5375 6e2c 2030 3920 4d61 7220 res=Sun,.09.Mar. 0x0100 3230 3033 2031 333a 3339 3a32 3220 474d 2003.13:39:22.GM 0x0110 543b 2050 6174 683d 2f0d 0a58 2d43 6163 T;.Path=/..X-Cac 0x0120 6865 3a20 4d49 5353 2066 726f 6d20 6572 he:.MISS.from.er 0x0130 7035 2e6f 7267 0d0a 4b65 6570 2d41 6c69 p5.org..Keep-Ali 0x0140 7665 3a20 7469 6d65 6f75 743d 3135 2c20 ve:.timeout=15,. 0x0150 6d61 783d 3130 300d 0a43 6f6e 6e65 6374 max=100..Connect 0x0160 696f 6e3a 204b 6565 702d 416c 6976 650d ion:.Keep-Alive. 0x0170 0a0d 0a20 0a0a 3c68 746d 6c3e 0a20 3c68 ......<html>..<h 0x0180 6561 643e 2020 0a20 203c 7469 746c 653e ead>.....<title> 0x0190 4552 5035 2043 6f6d 6d75 6e69 7479 3a20 ERP5.Community:. 0x01a0 4552 5035 2043 6f6d 6d75 6e69 7479 3c2f ERP5.Community</ 0x01b0 7469 746c 653e 0a20 203c 6c69 6e6b 2072 title>...<link.r __ac + Medusa 0x0000 4500 05dc 5485 4000 3306 6afb d42b ed44 E...T.@.3.j..+.D 0x0010 c0a8 0083 25c9 986a d8ef 56ab d93b a9d7 ....%..j..V..;.. 0x0020 8010 1f08 6115 0000 0101 080a 0214 0fb1 ....a........... 0x0030 01fa 7da9 4854 5450 2f31 2e31 2032 3030 ..}.HTTP/1.1.200 0x0040 204f 4b0d 0a53 6572 7665 723a 205a 6f70 .OK..Server:.Zop 0x0050 652f 285a 6f70 6520 322e 352e 3020 2873 e/(Zope.2.5.0.(s 0x0060 6f75 7263 6520 7265 6c65 6173 652c 2070 ource.release,.p 0x0070 7974 686f 6e20 322e 312c 206c 696e 7578 ython.2.1,.linux 0x0080 3229 2c20 7079 7468 6f6e 2032 2e31 2e32 2),.python.2.1.2 0x0090 2c20 6c69 6e75 7832 2920 5a53 6572 7665 ,.linux2).ZServe 0x00a0 722f 312e 3162 310d 0a44 6174 653a 2053 r/1.1b1..Date:.S 0x00b0 6174 2c20 3039 204d 6172 2032 3030 3220 at,.09.Mar.2002. 0x00c0 3133 3a34 393a 3131 2047 4d54 0d0a 436f 13:49:11.GMT..Co 0x00d0 6e74 656e 742d 5479 7065 3a20 7465 7874 ntent-Type:.text 0x00e0 2f68 746d 6c0d 0a45 7461 673a 200d 0a43 /html..Etag:...C 0x00f0 6f6e 7465 6e74 2d4c 656e 6774 683a 2035 ontent-Length:.5 0x0100 3931 330d 0a53 6574 2d43 6f6f 6b69 653a 913..Set-Cookie: 0x0110 205f 5f61 633d 2261 6e41 3659 5852 6862 .__ac="anA6YXRhb 0x0120 4746 7525 3041 223b 2050 6174 683d 2f0d GFu%0A";.Path=/. 0x0130 0a53 6574 2d43 6f6f 6b69 653a 205f 5f61 .Set-Cookie:.__a 0x0140 635f 6e61 6d65 3d22 6a70 223b 2045 7870 c_name="jp";.Exp 0x0150 6972 6573 3d53 756e 2c20 3039 204d 6172 ires=Sun,.09.Mar 0x0160 2032 3030 3320 3133 3a34 393a 3131 2047 .2003.13:49:11.G 0x0170 4d54 3b20 5061 7468 3d2f 0d0a 0d0a 200a MT;.Path=/...... 0x0180 0a3c 6874 6d6c 3e0a 203c 6865 6164 3e20 .<html>..<head>. 0x0190 200a 2020 3c74 6974 6c65 3e45 5250 3520 ....<title>ERP5. 0x01a0 436f 6d6d 756e 6974 793a 2045 5250 3520 Community:.ERP5. __ac + Apache w/o VHM 0x0000 4500 05dc b728 4000 3306 0858 d42b ed44 E....(@.3..X.+.D 0x0010 c0a8 0083 0050 9877 1bb1 2fcd 1b81 86ae .....P.w../..... 0x0020 8010 1920 6235 0000 0101 080a 0215 9941 ....b5.........A 0x0030 01fc 0733 4854 5450 2f31 2e31 2032 3030 ...3HTTP/1.1.200 0x0040 204f 4b0d 0a44 6174 653a 2053 6174 2c20 .OK..Date:.Sat,. 0x0050 3039 204d 6172 2032 3030 3220 3134 3a30 09.Mar.2002.14:0 0x0060 353a 3537 2047 4d54 0d0a 5365 7276 6572 5:57.GMT..Server 0x0070 3a20 4170 6163 6865 2f31 2e33 2e32 3320 :.Apache/1.3.23. 0x0080 2855 6e69 7829 2044 6562 6961 6e20 474e (Unix).Debian.GN 0x0090 552f 4c69 6e75 780d 0a43 6f6e 7465 6e74 U/Linux..Content 0x00a0 2d4c 656e 6774 683a 2035 3833 350d 0a43 -Length:.5835..C 0x00b0 6f6e 7465 6e74 2d54 7970 653a 2074 6578 ontent-Type:.tex 0x00c0 742f 6874 6d6c 0d0a 4574 6167 3a20 0d0a t/html..Etag:... 0x00d0 5365 742d 436f 6f6b 6965 3a20 5f5f 6163 Set-Cookie:.__ac 0x00e0 5f6e 616d 653d 226a 7022 3b20 4578 7069 _name="jp";.Expi 0x00f0 7265 733d 5375 6e2c 2030 3920 4d61 7220 res=Sun,.09.Mar. 0x0100 3230 3033 2031 343a 3035 3a35 3820 474d 2003.14:05:58.GM 0x0110 543b 2050 6174 683d 2f0d 0a58 2d43 6163 T;.Path=/..X-Cac 0x0120 6865 3a20 4d49 5353 2066 726f 6d20 6572 he:.MISS.from.er 0x0130 7035 2e6f 7267 0d0a 4b65 6570 2d41 6c69 p5.org..Keep-Ali 0x0140 7665 3a20 7469 6d65 6f75 743d 3135 2c20 ve:.timeout=15,. 0x0150 6d61 783d 3130 300d 0a43 6f6e 6e65 6374 max=100..Connect 0x0160 696f 6e3a 204b 6565 702d 416c 6976 650d ion:.Keep-Alive. 0x0170 0a0d 0a20 0a0a 3c68 746d 6c3e 0a20 3c68 ......<html>..<h 0x0180 6561 643e 2020 0a20 203c 7469 746c 653e ead>.....<title> 0x0190 4552 5035 2043 6f6d 6d75 6e69 7479 3a20 ERP5.Community:. 0x01a0 4552 5035 2043 6f6d 6d75 6e69 7479 3c2f ERP5.Community</ ac_erp5 + Apache w/o VHM 0x0000 4500 05dc 7e18 4000 3306 4168 d42b ed44 E...~.@.3.Ah.+.D 0x0010 c0a8 0083 0050 9879 1f55 e2db 1fa1 b673 .....P.y.U.....s 0x0020 8010 1d50 627a 0000 0101 080a 0215 bc04 ...Pbz.......... 0x0030 01fc 29f6 4854 5450 2f31 2e31 2032 3030 ..).HTTP/1.1.200 0x0040 204f 4b0d 0a44 6174 653a 2053 6174 2c20 .OK..Date:.Sat,. 0x0050 3039 204d 6172 2032 3030 3220 3134 3a30 09.Mar.2002.14:0 0x0060 373a 3236 2047 4d54 0d0a 5365 7276 6572 7:26.GMT..Server 0x0070 3a20 4170 6163 6865 2f31 2e33 2e32 3320 :.Apache/1.3.23. 0x0080 2855 6e69 7829 2044 6562 6961 6e20 474e (Unix).Debian.GN 0x0090 552f 4c69 6e75 780d 0a43 6f6e 7465 6e74 U/Linux..Content 0x00a0 2d4c 656e 6774 683a 2035 3833 350d 0a43 -Length:.5835..C 0x00b0 6f6e 7465 6e74 2d54 7970 653a 2074 6578 ontent-Type:.tex 0x00c0 742f 6874 6d6c 0d0a 4574 6167 3a20 0d0a t/html..Etag:... 0x00d0 5365 742d 436f 6f6b 6965 3a20 5f5f 6163 Set-Cookie:.__ac 0x00e0 5f65 7270 353d 2261 6e41 3659 5852 6862 _erp5="anA6YXRhb 0x00f0 4746 7525 3041 223b 2050 6174 683d 2f0d GFu%0A";.Path=/. 0x0100 0a58 2d43 6163 6865 3a20 4d49 5353 2066 .X-Cache:.MISS.f 0x0110 726f 6d20 6572 7035 2e6f 7267 0d0a 4b65 rom.erp5.org..Ke 0x0120 6570 2d41 6c69 7665 3a20 7469 6d65 6f75 ep-Alive:.timeou 0x0130 743d 3135 2c20 6d61 783d 3939 0d0a 436f t=15,.max=99..Co 0x0140 6e6e 6563 7469 6f6e 3a20 4b65 6570 2d41 nnection:.Keep-A 0x0150 6c69 7665 0d0a 0d0a 200a 0a3c 6874 6d6c live.......<html 0x0160 3e0a 203c 6865 6164 3e20 200a 2020 3c74 >..<head>.....<t 0x0170 6974 6c65 3e45 5250 3520 436f 6d6d 756e itle>ERP5.Commun 0x0180 6974 793a 2045 5250 3520 436f 6d6d 756e ity:.ERP5.Commun -- Jean-Paul Smets-Solanes <jp@nexedi.com> - Nexedi (CEO) GPG Fingerprint: 40FF FA78 75AA 680D 8BB4 EEF9 539A 79CC CB8E 5F01
Hi, I did a few more tests. Apparently, this cookie issue - happens in proxy mode - does not happen in CGI mode Of course, it is required to delete all cookies stored in the browser once the __ac cookie has been successfully set in CGI mode I have enclose an excerpt of my Apache config which shows various tests. JPS. <VirtualHost erp5.org> DocumentRoot /home/jp/public_html/erp5/ ServerName erp5.org ServerAlias www.erp5.org #ProxyPass / http://localhost:9673/VirtualHostBase/http/www.erp5.org:80/erp5/VirtualHostR... RewriteEngine on RewriteCond %{HTTP:Authorization} ^(.*) #RewriteRule ^/(.*) http://localhost:9673/VirtualHostBase/http/www.erp5.org:80/erp5/VirtualHostR... [L,P] #RewriteRule ^/(.*) http://localhost:9673/erp5/$1 [L,P] #RewriteRule ^/(.*) http://localhost:9673/VirtualHostBase/http/www.erp5.org:80/erp5/VirtualHostR... [L,P] RewriteRule ^/(.*) /usr/lib/cgi-bin/Zope/VirtualHostBase/http/www.erp5.org:80/erp5/VirtualHostRoot/$1 [e=HTTP_CGI_AUTHORIZATION:%1,t=application/x-httpd-cgi,l] </VirtualHost> -- Jean-Paul Smets-Solanes <jp@nexedi.com> - Nexedi (CEO) GPG Fingerprint: 40FF FA78 75AA 680D 8BB4 EEF9 539A 79CC CB8E 5F01
You will see that the Set-Cookie is different in the 5 cases
My conclusion for now is that something could be wrong with the Apache rewriting process.
Nope, cause I'm running Roxen.. and have the same behaviour. /Magnus
Jean-Paul Smets writes:
... TCPWatch dumps demonstrating cookie problem for "__ac" cookie ... When I read the dumps correct then *ALL* Apache + "__ac" dumps lack the "__ac" cookie whether or nor VHM is used. Thus, I would say, VHM is out of suspicion.
Now, Apache + Zope via "mod_proxy" is Zope via Medusa. I do not expect Zope to behave differently when Apache is there. As Zope (+ medusa) alone has the "__ac" cookie, this may indicate an Apache problem. You can verify that by using TCPWatch between Apache und Zope (rather than between your browser and Apache). Dieter
Le Samedi 9 Mars 2002 23:04, Dieter Maurer a écrit :
Jean-Paul Smets writes:
... TCPWatch dumps demonstrating cookie problem for "__ac" cookie ...
When I read the dumps correct then *ALL* Apache + "__ac" dumps lack the "__ac" cookie whether or nor VHM is used. Thus, I would say, VHM is out of suspicion.
I agree.
Now, Apache + Zope via "mod_proxy" is Zope via Medusa. I do not expect Zope to behave differently when Apache is there. As Zope (+ medusa) alone has the "__ac" cookie, this may indicate an Apache problem. You can verify that by using TCPWatch between Apache und Zope (rather than between your browser and Apache).
OK. I'll test this.
Dieter
_______________________________________________ Zope-Dev maillist - Zope-Dev@zope.org http://lists.zope.org/mailman/listinfo/zope-dev ** No cross posts or HTML encoding! ** (Related lists - http://lists.zope.org/mailman/listinfo/zope-announce http://lists.zope.org/mailman/listinfo/zope )
-- Jean-Paul Smets-Solanes <jp@nexedi.com> - Nexedi (CEO) GPG Fingerprint: 40FF FA78 75AA 680D 8BB4 EEF9 539A 79CC CB8E 5F01
Stefane Fermigier (www.nuxeo.com) sent this answer this morning. ---------- Message transmis ---------- Subject: [mjc@redhat.com: Apache Week issue 287] Date: Sat, 16 Mar 2002 08:12:53 +0100 From: Stefane Fermigier <sf@fermigier.com> To: jp@smets.com ----- Forwarded message from Apache Week <mjc@redhat.com> ----- Proxy users thinking of upgrading to Apache 1.3.23 should be aware that there is a bug ([5]PR#9655) in the handling of responses which set more than one cookie, and may wish to wait for the 1.3.24 release before upgrading. ----- End forwarded message ----- -- Stéfane Fermigier, Tel: +33 (0)6 63 04 12 77 (mobile). http://nuxeo.com/ & http://portalux.com/ & http://aful.org/ "Amazon: we patent the dot in .com" ------------------------------------------------------- -- Jean-Paul Smets-Solanes <jp@nexedi.com> - Nexedi (CEO) GPG Fingerprint: 40FF FA78 75AA 680D 8BB4 EEF9 539A 79CC CB8E 5F01
I can verify this. Same thing happens here too. I had to redirect login_form to :8080 before, since I could not login to CMF otherwise, using VHM. I changed auth_cookie from __ac to __ac_, and now I can login through VHM... Bug... I'll put it in the Collector. (I'm using a week old cvs snapshot of Zope-2_5-branch and CMF1.2) /Magnus
I started debugging Zope. I found that the various methods in CookieCrumbler are called and should normally set a cookie for auth_cookie.
However, under VHM operation, this does not happen when auth_cookie == '__ac'
I changed the name of the authentication cookie to __ac_erp5 in the CMF (www.erp5.org is the site I am working on).
Everything works fine now.
I have absolutely no idea what it can mean.
As a reminder, I had no problems for 6 months and suddenly, after a small upgrade, all this strange behaviour started.
participants (5)
-
Dieter Maurer -
Jean-Paul Smets -
Jean-Paul Smets -
Magnus Heino -
Shane Hathaway