assaf/zombie — Issue #284: Cookies are not sent to a foreign domain
Author: tcz
Created: 2012-02-21 01:12:41+00:00
State: open

Hi,

Here is the scenario I'm trying to test:

- user arrives to my page
- I redirect to user to Linkedin to do OAuth login
- Linkedin redirects the user back to my page

Now, the problem is that Zombie seems to have an issue with domains other than its starting domain, and therefore it doesn't send back some cookies that Linkedin sets.

### Reponse header from Linkedin ###

```
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: _lipt=deleteMe; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: JSESSIONID="ajax:xxx"; Version=1; Path=/
Set-Cookie: bcookie="v=2&xxx-xxx-xxx-xxx-xxx"; Version=1; Domain=linkedin.com; Max-Age=63072000; Expires=Thu, 20-Feb-2014 00:58:30 GMT; Path=/
P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE"
Set-Cookie: leo_auth_token="GST:xxx:xxx:xxx"; Version=1; Max-Age=1799; Expires=Tue, 21-Feb-2012 01:28:29 GMT; Path=/
Set-Cookie: sl="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: visit="v=1&G"; Version=1; Max-Age=63072000; Expires=Thu, 20-Feb-2014 00:58:30 GMT; Path=/
Set-Cookie: lang="v=2&lang=en"; Version=1; Domain=linkedin.com; Path=/
Set-Cookie: X-LI-IDC=C1
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Transfer-Encoding: chunked
Vary: Accept-Encoding
Date: Tue, 21 Feb 2012 00:58:30 GMT
```

### Request header sent by Zombie after filling Linkedin login form ###

```
POST https://www.linkedin.com/uas/oauth/authorize/submit HTTP/1.1
content-type: application/x-www-form-urlencoded
referer: https://www.linkedin.com/uas/oauth/authorize?oauth_token=xxx-xxx-xxx-xxx&state=
User-Agent: Mozilla/5.0 Chrome/10.0.613.0 Safari/534.15 Zombie.js/0.12.14
content-length: 261
Host: www.linkedin.com
cookie: JSESSIONID=ajax:xxx; leo_auth_token=GST:xxx:xxx:xxx; visit=v=1&G; X-LI-IDC=C1
Connection: keep-alive
```

As you can see, the cookies `JSESSIONID`, `leo_auth_token`, `visit` and `X-LI-IDC` are sent back correctly. These are the cookies that did not have domain attribute set.

However, `bcookie` and `lang` are not sent. I suspect it's because Zombie finds a domain mismatch, even though it should be OK with www.linkedin.com.

Note that `_lipt`, `sl`, `s_leo_auth_token` cookies where not sent back either, but it's fine as they have been removed in the response header.

I suspect that this is a problem with varying domains because at some point Zombie tries to load a Javascript file from my server, that is supposed to be used by Linkedin, so the problem might be something more general with switching domains while navigating.

I really like this library, so would love to help to fix this somehow.

Thanks a lot!