Re: LWP user agent query

On Fri, 26 Aug 2005, P.R.Brady wrote:

> I tried my web crawler/link checker on a neighbour's site and found problems
> with the button top right entitled 'cymraeg' in this page (and the same button
> on others):
> http://www.anglesey.gov.uk/english/community/health/smoke-free/smoke-free.htm

As soon as I click it, my browser throws an alert telling me that
the site wants to set a cookie.
However, even if I respond by allowing session cookies, I get an
error alert, telling me that "community could not be found".

> Internet Explorer seems very happy with the button and returns the Welsh
> version, but Netscape 7 is not entirely happy with it either.

That sounds ominouosly like the all too prevalent situation of a web
page that's been designed to work only with the operating system
compoment that thinks it's a browser, but not with a www-compatible
client agent.

> I think I need to extract the url:
> http://www.anglesey.gov.uk/cgi-bin/change_language.asp?language=cymraeg
> for the get as in the following code but I am getting 404 not found
> returned.

You've worked that out from the 'form method="GET" ...' which is used
to implement this switch, right?

Here's how their server seems to respond to that URL:


HTTP/1.1 302 Object moved
Connection: close
Date: Fri, 26 Aug 2005 14:48:58 GMT
Server: Microsoft-IIS/6.0
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Location: //
Content-Length: 123
Content-Type: text/html
Set-Cookie: ASPSESSIONIDSCTBSRDA=HDKPDDIDBPOGDPJLBCCGGGOL; path=/
Cache-control: private


That "Location:" looks meaningless to me. The HTTP specification
demands an absolute URL to be returned on a Location: header, and that
most certainly ain't one. Whatever a client agent would do in
response to it would seem to be in the nature of an error fixup, and
there's no reason to suppose clients would perform the same fix as
each other.

You might consider running LWP without automatically resolving
redirections, so that you get control back as soon as this code 302
response is returned, and try to fix this up yourself, if MSIE has
given you some clue about where it's supposed to go. You'll need to
have cookie handling enabled, too, of course. Sorry, I haven't tried
this at all - it's just a suggestion.


<rant>
It's bad enough that the source of the above web page has a DOCTYPE
that makes it look like HTML/2.0, which it clearly is not: but there's
a META that says it was extruded by Microsoft FrontPage 5.0, so the
likelihood of it working with anything that's WWW-compatible does not
seem too high...
</>

.

Relevant Pages

  • RE: "Divide and Conquer" - cross site response header tampering, cookie manipulation, and
    ... The attack I described, HTTP ... Response Splitting, ... cookie from their own web server while redirecting to another site. ... so the victim cannot maintain their session) or could be used ...
    (Bugtraq)
  • Re: How to fetch Cookie from response
    ... by passing user & password. ... I'm having problem with fetching cookies from the response & ... Some how its not giving me complete cookie & hence I'm getting ... puts "1st Code = #" ...
    (comp.lang.ruby)
  • Re: Debugging ScreenScrape Code
    ... You are creating cookie container, which creates an empty cookie container. ... You are assigning it to each web request. ... response, you aren't saving the cookies into the cookie container. ... > private string LOGIN_URL; ...
    (microsoft.public.dotnet.languages.csharp)
  • session variable and asynchrous call
    ... retrieves some user information it uses from a webservice. ... to update the cookie values. ... until after the response has been streamed to the client, ... in Session variables using the state object. ...
    (microsoft.public.dotnet.framework)
  • Re: Sharepoint Versions on office documents
    ... (I only had a brief look at this myself a while back and saw no really obvious fix, but I hope to have a better look sometime). ... Peter Jamieson ... "cookie" wrote in message ... show the dynamic version on the footer of the document etc, ...
    (microsoft.public.word.docmanagement)