Cookie handling is borked

[GoogleCodeExporter]

What steps will reproduce the problem?
1. Use the example usage in HTTPNtlmAuthHandler.py, modify url, user, and
password as needed. url points to a asp session based server
2. modify the code to enable httplib debug
3. run it an watch how the session cookie is dropped.

What is the expected output? What do you see instead?
I expect the session cookie to be sent back to the server. It was not.


What version of the product are you using? On what operating system?
Unknown version...pulled from svn. Ubuntu 8.10, fully up-to-date.


Please provide any additional information below.

1. It seems you are looking in the wrong place for the headers in
HTTPNtlmAuthHandler.py, in retry_using_http_NTLM_auth. One of the arguments
to this method is 'headers', and this contains the headers, while
req.headers is always empty.

2. The capitalization is wrong for the Set-Cookie header in
retry_using_http_NTLM_auth. You have "set-cookie", it should be
"Set-Cookie" (or possibly be made case-insensitive).

 3. Also in retry_using_http_NTLM_auth, you convert the headers to a dict
using the dict object's constructor. The problem with this is that you can
only support one cookie this way. When the servers send you three cookies,
you get three Set-Cookie headers, but putting them in a dict in this way
you only get the last one in the dict. Also, you should probably be using
cookielib to handle the cookies.


I'm working on fixes for all of these for my own use. I can submit a patch
once they are ready if you want, but I'll be out next week, so I could not
provide until September.

Thanks.

Original issue reported on code.google.com by [email protected] on 20 Aug 2009 at 4:58

[GoogleCodeExporter]

Thank you for reporting and looking into this bug. If you come up with solutions
along the line you are suggesting I will be glad to include them into the 
repository.

Original comment by Matthijs.Mullender on 21 Aug 2009 at 5:12

[GoogleCodeExporter]

I'm experiencing problems with this bug also.

Was a patch created?

Original comment by [email protected] on 13 Mar 2010 at 3:51

[GoogleCodeExporter]

not yet

Original comment by Matthijs.Mullender on 15 Mar 2010 at 7:39