On 04/30/2014 09:59 AM, Martin Gruner wrote:
> In Kernel/Output/HTML/Layout.pm:
>
>> @@ -541,7 +541,7 @@ sub Redirect {
>>      my $Output = $Cookies . $Self->Output( TemplateFile => 'Redirect', Data => \%Param );
>>
>>      # add session id to redirect if no cookie is enabled
>> -    if ( !$Self->{SessionIDCookie} ) {
>> +    if ( !$Self->{SessionIDCookie}  && !$Self->{BrowserHasCookie} ) {
>
> Ok, thanks for pointing this out. I still think this is wrong. In most
> places we only want to know if the session cookie is available (and not
> if the browser supports cookies at all), the login would be an
> exception.  Imagine the case where the session cookie expires, then your
> check would cause an error.

I'm thoroughly confused. If the session cookie expires, don't we *want* 
the user to log in again? If not, what's the point of an expiry date?

> That might be an indication for setting the
> test cookie to a similar length as the session cookie, btw. In fact we
> only need the test cookie until the login! We might even delete it then
> again to avoid problems with changed cookie browser settings in
> future... How about adding a parameter to Redirect() that is only used
> by the login and suppresses the SID adding to the URL? That would better
> reflect the exceptionality of the login.

OK, I can add that.

Cheers,
Moritz