<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Steve,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve used this in the past for some standalone embedded package mobile stuff (also for authentication). I don’t recall ever reading any doc’s on it either and discovered that it worked accidentally at the time.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">50/50 on it now, but I would think that this might be in use more than generally thought. So if the functionality can be preserved, also documentation might make it useful/more useful in general as a feature/tool.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Bobb<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:.5in"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">MapServer-dev <mapserver-dev-bounces@lists.osgeo.org> on behalf of Even Rouault <even.rouault@spatialys.com><br>
<b>Date: </b>Friday, September 24, 2021 at 2:26 PM<br>
<b>To: </b>Steve Lime <sdlime@gmail.com>, "mapserver-dev@lists.osgeo.org" <mapserver-dev@lists.osgeo.org><br>
<b>Subject: </b>Re: [mapserver-dev] Cookies as Params<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<table class="MsoNormalTable" border="1" cellpadding="0" style="margin-left:.5in;background:#E2F700;border:solid black 1.0pt">
<tbody>
<tr>
<td style="border:none;padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><strong><span style="font-family:"Calibri",sans-serif;color:#FF3333">Think Before You Click:
</span></strong><span style="color:black">This email originated <strong><span style="font-family:"Calibri",sans-serif">outside
</span></strong>our organization.</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div>
<p style="margin-left:.5in">Steve,<o:p></o:p></p>
<p style="margin-left:.5in">Different options that come to mind:<o:p></o:p></p>
<p style="margin-left:.5in">- as we are the ones in loadParams() to parse HTTP_COOKIE and turn its content as ParamValues[]/ParamNames[], we could potentially have a list CookieParamNames[] where we'd store those parameter names coming from cookies and the
OGC API code could use to determine if the parameter comes from the query string or not. Parameters coming from cookies could then be ignored<o:p></o:p></p>
<p style="margin-left:.5in">- or in OGC API mode, ignore completely HTTP_COOKIE. I'm not sure to which extent it is expected that the cookies the client send back to the server are considered as query parameters.<o:p></o:p></p>
<p style="margin-left:.5in">- or remove completely that functionality. I guess it is mostly your call Steve as I see you're the one who added it in 2003 :-) And looking at the docs
<a href="https://github.com/MapServer/MapServer-documentation/search?q=cookie">https://github.com/MapServer/MapServer-documentation/search?q=cookie</a> , it seems to be undocumented, so probably only a few mortals are aware of it. The only reference to cookies
is the RFC 42 cookie forwarding mechanism, which is something else. The code in cgiutil.c should just be stripped down to the following to keep RFC 42 working (AFAICS ! I'm discovering all that stuff when writing this email :-)):<o:p></o:p></p>
<p style="margin-left:.5in"> s = getenv2("HTTP_COOKIE", thread_context);<br>
if(s != NULL) {<br>
request->httpcookiedata = msStrdup(s);<br>
}<o:p></o:p></p>
<p style="margin-left:.5in">- for AJAX jQuery, I've found mentions of the "callback" query parameter name. If it is the only one, perhaps we could just silently ignore it, assuming it comes from AJAX<o:p></o:p></p>
<p style="margin-left:.5in">- add a "oga_compliant" "true" setting that would be set only when running CITE testing where we reject unknown query parameter names. And by default / "false", ignore them silently<o:p></o:p></p>
<p style="margin-left:.5in">Even<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:.5in">Le 24/09/2021 à 20:32, Steve Lime a écrit :<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:.5in">Hi all: MapServer has always treated cookies as parameters. Those values are added to the parameter names and values arrays and are basically just another way to set standard request parameters. This can cause a
problem with OGC API specs that require exceptions be generated when unexpected parameters are encountered. Note that standard AJAX use with something like jQuery can also trigger the exception when it tags on params to make calls unique - so there's more
to discuss. <o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">Anyway, it got me wondering if we need to continue to handle cookies at all. I don't see much value and simpler is better but I don't know if others might be using that feature... Thoughts?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in">--Steve <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:.5in"><br>
<br>
<o:p></o:p></p>
<pre style="margin-left:.5in">_______________________________________________<o:p></o:p></pre>
<pre style="margin-left:.5in">MapServer-dev mailing list<o:p></o:p></pre>
<pre style="margin-left:.5in"><a href="mailto:MapServer-dev@lists.osgeo.org">MapServer-dev@lists.osgeo.org</a><o:p></o:p></pre>
<pre style="margin-left:.5in"><a href="https://lists.osgeo.org/mailman/listinfo/mapserver-dev">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</a><o:p></o:p></pre>
</blockquote>
<pre style="margin-left:.5in">-- <o:p></o:p></pre>
<pre style="margin-left:.5in"><a href="http://www.spatialys.com">http://www.spatialys.com</a><o:p></o:p></pre>
<pre style="margin-left:.5in">My software is free, but my time generally not.<o:p></o:p></pre>
</div>
</div>
</body>
</html>