#1
  1. No Profile Picture
    Contributing User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Feb 2004
    Posts
    71
    Rep Power
    11

    Deleting cookie in IE6


    Hi.
    I need some help here please.
    I am building a site that needs authorization.
    In order to do that , I am issuing a cookie in the login page,
    and on every page, I'm checking if the cookie exists.
    The problem begins when the user chooses " log out"
    (which supposed to delete the cookie from the user's machine and redirect to the login page).
    It works great in Mozilla and in Konqueror, but IE6 refuses to discard the cookie (and therefore allows access to pages (when the user clicks "Back" button or writing the url ) , eventhough the user is 'logged out')


    the headers are the following:
    # some defines
    SESSION_COOKIE_NAME = "CookieName"
    COOKIE_EXPIRE = 6000
    companyID = 1

    To issue the cookie:
    print 'Content-Type: text/html'
    print 'Set-Cookie:'+SESSION_COOKIE_NAME+'="'+(str)(companyID)+'";Version="1.0";Max-Age="'+(str)(COOKIE_EXPIRE)+'"'
    print 'Cache-Control: no-cache=set-cookie'
    print 'Cache-Control: max-age="0"'
    print "\n\n"

    To delete the cookie:
    print 'Content-Type: text/html'
    print 'Set-Cookie: '+SESSION_COOKIE_NAME+'="'+(str)(companyID)+'";Version="1.0";Max-Age="0"'
    print 'Cache-Control: no-cache=set-cookie'
    print 'Cache-Control: max-age="0"'
    print "\n\n"


    In all the pages (besides the login page). there is a check if the cookie exists.
    After logout, the check in IE6 shows that the cookie still exists.
    I'm assuming that it has to do with caching the cookie on IE6.
    I tried using headers that suppose to surpress the caching of the pages as well as surpressing the Set-Cookie header caching.
    I used the recommendations written in the RFC2109 but it still doesn't work.
    ( I can't verify that the cookie exists / not exists in IE6 because I can't find it in the Hard drive)

    Thanks for your help
    Roy
    Last edited by roypython; April 27th, 2004 at 06:41 PM.
  2. #2
  3. No Profile Picture
    Registered User
    Devshed Newbie (0 - 499 posts)

    Join Date
    Apr 2003
    Posts
    25
    Rep Power
    0

    Lightbulb


    I would recommend setting another cookie indicating that the user had logged out.
    You could also put a date in the original cookie and have your code not allow the user back until a certain time after that date. good luck
  4. #3
  5. Hello World :)
    Devshed Frequenter (2500 - 2999 posts)

    Join Date
    Mar 2003
    Location
    Hull, UK
    Posts
    2,537
    Rep Power
    69
    In theory (and i've had no problems with this) reseting the cookie with an expired timestamp should remove it. This could have something to do with the way you are type-casting as i've never seen the:

    (str)(companyID)

    in Python before. In which case you should check this form in IDLE but i dont believe this is what you want... try

    str(companyID)

    instead. You might also want to look and the Cookies module

    Hope this helps,

    Mark.
    programming language development: www.netytan.com Hula


IMN logo majestic logo threadwatch logo seochat tools logo