All pastes #1261320 Raw Edit

Mine

public text v1 · immutable
#1261320 ·published 2008-11-19 12:52 UTC
rendered paste body
I'm having login problems and I think I've traced it back to cookies. Here are the steps I use to reproduce the problem.

First, here is a process that works correctly.

1) Log out of TMB.
2) Go to http://tmb.dj/torrent/search/?search=tag%3Atrance and be sure NOT to include the "www" before "tmb.dj".
3) You are redirected to http://tmb.dj/login/.
4) Login as usual.
5) After a successful login, you are redirected to http://tmb.dj/torrent/search/?search=tag%3Atrance

Now, here is how I reproduce my problem.

1) Log out of TMB.
2) Go to http://www.tmb.dj/torrent/search/?search=tag%3Atrance and be sure to include the "www" before "tmb.dj".
3) You are redirected to http://tmb.dj/login/. Note the lack of the "www".
4) Login as usual.
5) After a successful login, you remain at http://tmb.dj/login/ but are told "You are already logged in. Click here to log out."
6) Again, go to http://www.tmb.dj/torrent/search/?search=tag%3Atrance and be sure to include the "www" before "tmb.dj".
7) Again you are redirected to http://tmb.dj/login/ and are told "You are already logged in. Click here to log out."
8) Go to http://tmb.dj/torrent/search/?search=tag%3Atrance and be sure NOT to include the "www" before "tmb.dj".
9) You arrive at the page normally.

I think I've tracked the problem down to how the cookie is built. The host value of the cookie is being set as "tmb.dj". It should be set as ".tmb.dj" (note that leading period) to allow the cookie to work for both "www.tmb.dj" and "tmb.dj".

All of this is reproducible for "themixingbowl.org" and "www.themixingbowl.org".