The getCookiePath() function was assuming that the full path name of
the current URL includes the full filename - for example
/sub-folder/index.php.
However, where the browser visits the parent folder and the default file
is served (/sub-folder/ serving /sub-folder/index.php) the wrong
current URL is returned.
This means that the deleteCookie function tries to delete for the parent
folder upwards, and where the cookie was set in a specific path, the
delete fails.
The
getCookiePath()
function was assuming that the full path name of the current URL includes the full filename - for example/sub-folder/index.php
.However, where the browser visits the parent folder and the default file is served (
/sub-folder/
serving/sub-folder/index.php
) the wrong current URL is returned.This means that the deleteCookie function tries to delete for the parent folder upwards, and where the cookie was set in a specific path, the delete fails.
For example:
Given a cookie set with:
The following would fail:
The
setCookie
call would calldeleteCookie
, which fetches the URL to delete. ThegetCookiePath()
function would behaved such that:Then, when fetching and expiring the cookie on the jar, the path of
/some/
was used to try and find a cookie located at/some/sub-folder/
.As a result the call to both get and expire the cookie from the jar would fail as the path was never exact enough.