<!DOCTYPE html><html><head><title></title><style type="text/css">#qt p.qt-MsoNormal{margin-top:0in;margin-right:0in;margin-left:0in;margin-bottom:0.0001pt;font-size:11pt;font-family:"Calibri", sans-serif;}
#qt a:link{color:blue;text-decoration-line:underline;text-decoration-style:solid;text-decoration-color:currentcolor;text-decoration-thickness:auto;}
#qt pre{margin-top:0in;margin-right:0in;margin-left:0in;margin-bottom:0.0001pt;font-size:10pt;font-family:"Courier New";}
p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>Hi Steve,<br></div><div><br></div><div>I'm also using the cookie as parameter approach in a project - an authentication token can be passed along with the request and then used as a runtime substitution parameter to add access security to certain layers. Approach was thanks to Mike at 2am at a bar in Bucharest..!<br></div><div><br></div><div>Even's approach of adding these to a CookieParamNames[] sounds the nicest approach, but I'd imagine also the hardest to implement. <br></div><div><br></div><div>I would be in favour of removing the check for additional parameters completely, but I understand the rationale of wanting to avoid clients thinking they are requesting something they are not as explained at <a href="https://stackoverflow.com/questions/20526784/restful-api-correct-behaviour-when-spurious-not-requested-parameters-are-passe/20686925#20686925">https://stackoverflow.com/questions/20526784/restful-api-correct-behaviour-when-spurious-not-requested-parameters-are-passe/20686925#20686925</a><br></div><div><br></div><div>Most JS frameworks allow disabling "cache-busting" parameters. I also like Even's option of "oga_compliant" "true". Maybe have it true by default and allow it to be set to false to allow any additional parameters - querystring or cookie?<br></div><div><br></div><div>Seth<br></div><div><br></div><div id="sig62266145"><div class="signature">--<br></div><div class="signature">web:http://geographika.co.uk<br></div><div class="signature">twitter: @geographika<br></div></div><div><br></div><div><br></div><div>On Fri, Sep 24, 2021, at 10:54 PM, Basques, Bob (CI-StPaul) wrote:<br></div><blockquote type="cite" id="qt" style=""><div class="qt-WordSection1"><p class="qt-MsoNormal">Steve,<br></p><p class="qt-MsoNormal"> <br></p><p class="qt-MsoNormal">I’ve used this in the past for some standalone embedded package mobile stuff (also for authentication). I don’t recall ever reading any doc’s on it either and discovered that it worked accidentally at the time.<br></p><p class="qt-MsoNormal"> <br></p><p class="qt-MsoNormal">50/50 on it now, but I would think that this might be in use more than generally thought. So if the functionality can be preserved, also documentation might make it useful/more useful in general as a feature/tool.<br></p><p class="qt-MsoNormal"> <br></p><p class="qt-MsoNormal">Bobb<br></p><p class="qt-MsoNormal"> <br></p><p class="qt-MsoNormal"> <br></p><p class="qt-MsoNormal"> <br></p><div style="border-right-color:currentcolor;border-right-style:none;border-right-width:medium;border-bottom-color:currentcolor;border-bottom-style:none;border-bottom-width:medium;border-left-color:currentcolor;border-left-style:none;border-left-width:medium;border-image-outset:0;border-image-repeat:stretch;border-image-slice:100%;border-image-source:none;border-image-width:1;border-top-color:rgb(181, 196, 223);border-top-style:solid;border-top-width:1pt;padding-top:3pt;padding-right:0in;padding-bottom:0in;padding-left:0in;"><p class="qt-MsoNormal" style="margin-left:0.5in;"><b><span style="color:black;"><span class="size" style="font-size:12pt;">From: </span></span></b><span style="color:black;"><span class="size" style="font-size:12pt;">MapServer-dev <mapserver-dev-bounces@lists.osgeo.org> on behalf of Even Rouault <even.rouault@spatialys.com><br> <b>Date: </b>Friday, September 24, 2021 at 2:26 PM<br> <b>To: </b>Steve Lime <sdlime@gmail.com>, "mapserver-dev@lists.osgeo.org" <mapserver-dev@lists.osgeo.org><br> <b>Subject: </b>Re: [mapserver-dev] Cookies as Params</span></span></p></div><div><p class="qt-MsoNormal" style="margin-left:0.5in;"> <br></p></div><table class="qt-MsoNormalTable" style="margin-left:0.5in;background-color:rgb(226, 247, 0);background-position-x:0%;background-position-y:0%;background-repeat:repeat;background-attachment:scroll;background-image:none;background-size:auto;background-origin:padding-box;background-clip:border-box;border-top-color:black;border-top-style:solid;border-top-width:1pt;border-right-color:black;border-right-style:solid;border-right-width:1pt;border-bottom-color:black;border-bottom-style:solid;border-bottom-width:1pt;border-left-color:black;border-left-style:solid;border-left-width:1pt;border-image-outset:0;border-image-repeat:stretch;border-image-slice:100%;border-image-source:none;border-image-width:1;" cellpadding="0" border="1"><tbody><tr><td style="border-top-color:currentcolor;border-top-style:none;border-top-width:medium;border-right-color:currentcolor;border-right-style:none;border-right-width:medium;border-bottom-color:currentcolor;border-bottom-style:none;border-bottom-width:medium;border-left-color:currentcolor;border-left-style:none;border-left-width:medium;border-image-outset:0;border-image-repeat:stretch;border-image-slice:100%;border-image-source:none;border-image-width:1;padding-top:0.75pt;padding-right:0.75pt;padding-bottom:0.75pt;padding-left:0.75pt;"><p class="qt-MsoNormal" style=""><b><span style="color:rgb(255, 51, 51);"><span class="font" style="font-family:"Calibri", sans-serif;">Think Before You Click: </span></span></b><span style="color:black;">This email originated <b><span style=""><span class="font" style="font-family:"Calibri", sans-serif;">outside </span></span></b>our organization.</span><br></p></td></tr></tbody></table><p class="qt-MsoNormal" style="margin-left:0.5in;"> <br></p><div><p style="margin-left:0.5in;">Steve,<br></p><p style="margin-left:0.5in;">Different options that come to mind:<br></p><p style="margin-left:0.5in;">- as we are the ones in loadParams() to parse HTTP_COOKIE and turn its content as ParamValues[]/ParamNames[], we could potentially have a list CookieParamNames[] where we'd store those parameter names coming from cookies and the
OGC API code could use to determine if the parameter comes from the query string or not. Parameters coming from cookies could then be ignored<br></p><p style="margin-left:0.5in;">- or in OGC API mode, ignore completely HTTP_COOKIE. I'm not sure to which extent it is expected that the cookies the client send back to the server are considered as query parameters.<br></p><p style="margin-left:0.5in;">- or remove completely that functionality. I guess it is mostly your call Steve as I see you're the one who added it in 2003 :-) And looking at the docs <a href="https://github.com/MapServer/MapServer-documentation/search?q=cookie">https://github.com/MapServer/MapServer-documentation/search?q=cookie</a> , it seems to be undocumented, so probably only a few mortals are aware of it. The only reference to cookies
is the RFC 42 cookie forwarding mechanism, which is something else. The code in cgiutil.c should just be stripped down to the following to keep RFC 42 working (AFAICS ! I'm discovering all that stuff when writing this email :-)):<br></p><p style="margin-left:0.5in;"></p><div> s = getenv2("HTTP_COOKIE", thread_context);<br></div><div> if(s != NULL) {<br></div><div> request->httpcookiedata = msStrdup(s);<br></div><div> }<br></div><p></p><p style="margin-left:0.5in;">- for AJAX jQuery, I've found mentions of the "callback" query parameter name. If it is the only one, perhaps we could just silently ignore it, assuming it comes from AJAX<br></p><p style="margin-left:0.5in;">- add a "oga_compliant" "true" setting that would be set only when running CITE testing where we reject unknown query parameter names. And by default / "false", ignore them silently<br></p><p style="margin-left:0.5in;">Even<br></p><div><p class="qt-MsoNormal" style="margin-left:0.5in;">Le 24/09/2021 à 20:32, Steve Lime a écrit :<br></p></div><blockquote style="margin-top:5pt;margin-bottom:5pt;"><div><p class="qt-MsoNormal" style="margin-left:0.5in;">Hi all: MapServer has always treated cookies as parameters. Those values are added to the parameter names and values arrays and are basically just another way to set standard request parameters. This can cause a
problem with OGC API specs that require exceptions be generated when unexpected parameters are encountered. Note that standard AJAX use with something like jQuery can also trigger the exception when it tags on params to make calls unique - so there's more
to discuss.<br></p><div><p class="qt-MsoNormal" style="margin-left:0.5in;"> <br></p></div><div><p class="qt-MsoNormal" style="margin-left:0.5in;">Anyway, it got me wondering if we need to continue to handle cookies at all. I don't see much value and simpler is better but I don't know if others might be using that feature... Thoughts?<br></p></div><div><p class="qt-MsoNormal" style="margin-left:0.5in;"> <br></p></div><div><p class="qt-MsoNormal" style="margin-left:0.5in;">--Steve <br></p></div></div><p class="qt-MsoNormal" style="margin-left:0.5in;"></p><div><br></div><p></p><pre style="margin-left:0.5in;">_______________________________________________<br></pre><pre style="margin-left:0.5in;">MapServer-dev mailing list<br></pre><pre style="margin-left:0.5in;"><a href="mailto:MapServer-dev@lists.osgeo.org">MapServer-dev@lists.osgeo.org</a><br></pre><pre style="margin-left:0.5in;"><a href="https://lists.osgeo.org/mailman/listinfo/mapserver-dev">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</a><br></pre></blockquote><pre style="margin-left:0.5in;">-- <br></pre><pre style="margin-left:0.5in;"><a href="http://www.spatialys.com">http://www.spatialys.com</a><br></pre><pre style="margin-left:0.5in;">My software is free, but my time generally not.<br></pre></div></div><div>_______________________________________________<br></div><div>MapServer-dev mailing list<br></div><div><a href="mailto:MapServer-dev@lists.osgeo.org">MapServer-dev@lists.osgeo.org</a><br></div><div><a href="https://lists.osgeo.org/mailman/listinfo/mapserver-dev">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</a><br></div><div><br></div></blockquote><div><br></div></body></html>