Re: Reading Cookie in an Asynchronous Pluggable Protocol

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Igor.

I am implementing an HTTP - HTTPS Pluggable protocol (I know microsoft
suggest not to do this but I have a reason why it is needed). I have it
working correctly and eventually I will implement my own cookie store to
completely remove WinInet dependency from the Pluggable Protocol. Currently
I was trying to use WinInet to handle the cookies and it seems to work
correctly but I have an issue with I think cookies that are markes as
HTTPonly (Sorry I realize I said session cookies in the original note), I
don't seem to be getting them returned in the InternetGetCookie call. I have
one instance (logging into eBay) where I can even see the cookie in the
cookie file on disk but it is does not seem to get returned in this call.

I have read on the web that cookies marked as HTTPOnly will not be returned
in this call because they are only supposed to be sent to the server during
the HTTP request. Is this true or was that a mistake? Is there any way to
retrieve these without letting WinInet handle the HTTP request?

I may just have to implement my own cookie store to make this work correctly
now but I was trying to complete the prototype a bit quicker.

Thanks

JPags




"Igor Tandetnik" wrote:

"JPags" <JPags@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:219E7FC4-D133-4096-AEF8-3C988CD41D73@xxxxxxxxxxxxx
I am trying to get all the cookies which are passed to the server
during a request in an Asynchronous Pluggable Protocol. I have use
the InternetGetCookie call which gets me all the persistent cookies
but I need to know how to get any session or HTTPOnly cookies from
the browser or WinInet.

InternetGetCookie should retrieve both permanent and session cookies,
when called from the same process from which request is made. Session
cookies are stored in memory on a per-process basis.

I have tried calling GetBindString with BINDSTRING POST COOKIE, but I
only get back a hex value which looks like a handle of some sort

POST cookie has absolutely nothing to do with HTTP cookies. It's some
unique identifier used internally by IE, not sure what for.

and
there is no documentation about what to do with this value to get the
actual cookie to pass to the server.

How do you make the request? If you use WinInet, WinInet will send
cookies automatically, unless you explicitly specify you don't want it
to. Are you implementing HTTP from scratch, at socket level? What are
you trying to achieve?
--
With best wishes,
Igor Tandetnik

With sufficient thrust, pigs fly just fine. However, this is not
necessarily a good idea. It is hard to be sure where they are going to
land, and it could be dangerous sitting under them as they fly
overhead. -- RFC 1925



.

Relevant Pages

  • Re: Screen Scraping a Password Protected Site
    ... http traffic. ... cookies to a singleton CookieContainer and the once you have logged in ... If TypeOf request Is HttpWebRequest Then ... If TypeOf response Is HttpWebResponse Then ...
    (microsoft.public.dotnet.languages.vb)
  • Re: [Full-disclosure] [Webappsec] Paper: Weaning the Web off of Session Cookies
    ... Always good to try and raise the bar, but the world has voted cookies ... Great writeup of the state of the union for Web-based authentication methods. ... your paper is primarily an argument for fixing HTTP ... "If We Wean the Web Off of Session Cookies, This Is Some of What We'd ...
    (Full-Disclosure)
  • Re: [Webappsec] Paper: Weaning the Web off of Session Cookies
    ... Always good to try and raise the bar, but the world has voted cookies ... Great writeup of the state of the union for Web-based authentication methods. ... your paper is primarily an argument for fixing HTTP ... "If We Wean the Web Off of Session Cookies, This Is Some of What We'd ...
    (Bugtraq)
  • Re: How hard is socket programming?
    ... single executable that now has web server capability. ... I don't know if it has cookies. ... IETF HTTP AUTH standard BASIC and DIGEST, ... CString HtmlToText(const char *s) ...
    (microsoft.public.vc.mfc)
  • Re: XMLRPC Ruby 1.8.6 stdlib Authentication/docs
    ... a client and a Mock of the Rails server. ... HTTP be used as the communications channel. ... Both HTTP Authentication and Cookies are optional ... The long answer is that the handler should not ...
    (comp.lang.ruby)