Cannot log in using Safari

Checking "Remember me on this computer" will allow the login, so this is surely a cookies issue.

This is an important bug and looks like a regression (I'm pretty sure I could log in before when using Safari). BTW I could reproduce the bug on trunk (3.0-SNAPSHOT) with Safari 5.0.3.

Mark, what version of Safari did you try with?

I can reproduce it with Safari 5.0.3 but not with Safari 4.0.4.

I'm not sure if it's a regression in XWiki or a regression in Safari. Try logging in on older wikis.

I have been using Safari 5.0.2 and Safari Mobile on iOS 4.2.1. I have an important deadline coming up for our project, and will not be able to try installing older versions of XWiki for at least a week.

Normal login looks like this:

HTTP/1.1 200 
Date: Fri, 28 Jan 2011 15:28:46 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=nzqorvrfcuj0;Path=/xwiki
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en
Set-Cookie: username="obD1aIklU0E_"; Version=1; Discard; Path=/; HttpOnly
Set-Cookie: password="FS1YvSKKiX8_"; Version=1; Discard; Path=/; HttpOnly
Set-Cookie: rememberme="false"; Version=1; Discard; Path=/; HttpOnly
Set-Cookie: validation="a4da3766f8b507af470ed6867afb6129"; Version=1; Discard; Path=/; HttpOnly

Login with remember me set looks like this:

HTTP/1.1 200 
Date: Fri, 28 Jan 2011 16:03:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=19jk0qicbkm1d;Path=/xwiki
Content-Type: text/html; charset=ISO-8859-1
Content-Language: en
Set-Cookie: username="obD1aIklU0E_"; Version=1; Max-Age=1296000; Expires=Sat, 12-Feb-2011 16:07:36 GMT; Path=/; HttpOnly
Set-Cookie: password="FS1YvSKKiX8_"; Version=1; Max-Age=1296000; Expires=Sat, 12-Feb-2011 16:07:38 GMT; Path=/; HttpOnly
Set-Cookie: rememberme="true"; Version=1; Max-Age=1296000; Expires=Sat, 12-Feb-2011 16:07:41 GMT; Path=/; HttpOnly
Set-Cookie: validation="a4da3766f8b507af470ed6867afb6129"; Version=1; Max-Age=1296000; Expires=Sat, 12-Feb-2011 16:07:50 GMT; Path=/; HttpOnly

Looks like Safari 5 doesn't like cookies without an expiration date. Also, note that after the normal login (which fails) I have this cookies set:

192.168.2.3 JSESSIONID /xwiki                       19z9...ff1j
192.168.2.3 username   /xwiki/bin/loginsubmit/XWiki obD1aIklU0E_

This http://extechops.net/2010/11/15/safari-rejects-cookies-with-version-discard-attributes/ seems to be the problem.

When "Discard" is present in the Set-Cookie header, the Path is ignored, and the cookie is set for the current path (loginsubmit). Thus, the cookies are saved, but only for a useless path.

I'm checking various settings of the cookie header, maybe something else comes up.

OK, it seems that everything that comes after the Discard; segment of the Set-Cookie header is ignored. Normally, the header looks like:

Set-Cookie: password="something__"; Version=1; Discard; Domain=.myxwiki.org; Path=/; HttpOnly

It works if I change it to:

Set-Cookie: password="something__"; Version=1; Domain=.myxwiki.org; Path=/; HttpOnly; Discard

I'll check if I can change this in the code.

Fixed in r34273.

Still NOT working with xwiki-enterprise-jetty-hsqldb-3.0-20110202.002708-137.zip 02-Feb-2011 01:31

Can't log in without clicking "Remember me"

Windows 7 - Safari 5.0.3

Also tried on 3.0M2-SNAPSHOT built on the 2nd of Feb and it's not working with Safari 5 either on my machine (Mac)

Really fixed in r34469.

Seems that Safari doesn't only discard the rest of the current Cookie header, but all the other cookies as well. So, while I tested with one cookie and saw that it was set correctly, I didn't test with more than one cookie initially. In practice, only the username cookie was stored, while the other cookies (password and validation) were dropped. Thus, the login wasn't valid, and the user was immediately logged out.

As a solution, I removed the Discard token completely, now cookies will be recognized as session cookies only by the lack of a Max-Age token.

Tested. Works. Thanks Sergiu