php cookie behaviour changes in recent versions

Question

I have a website written in-house, using a 3rd party login mechanism.

Recently we've been required to maintain PCI compliance, and I made a lot of changes in the environment. Shortly after we noticed a problem with cookies. I've rolled back all of the changes except the more difficult one of moving from php 5.3 back to 5.2.11, or whatever it was.

Here's what's happening. For our own internal administration I had written a login page that would take the user's name and password as a query string, The admin page for each user would have a 'become' link that would let us log in as that person. The page would overwrite the cookies of the admin with the cookies of the user, and we're THEM. As far as I know, it didn't delete any cookies first, just overwrote. It worked, until recently. Yes, insecure, but it's internal, please forgive me.

Now when we follow the links, our admins are staying admin. The only way to become a customer is log out, then type in their username/password.

The other thing I've noticed is that there's cookies set for each sub directory of the site, where before I think there was only one for the site itself. But I'm NOT positive that this has changed, there may have been subdirectories before...

So, I'm hoping the problem lies in a way that PHP is handling cookies in 5.3, either by not overwriting existing cookies any longer, or creating directory specific cookies instead of site wide.

Any ideas?

Answer 1

According to this, $_COOKIE values do not flow into $_REQUEST anymore, although I can't find official confirmation of it. If it's true, and your application works with $_REQUEST to load the admin ookies, this might be it. The cookies get set, but never make their way to your authentication mechanism. Because the normal user is identified by session and not by cookie, there's no problem there.

But this could just as well be a browser behaviour change, or a change in the server environment. It might be worth confirming first where exactly it comes from.

Does it happen with older browsers as well, say Firefox 2?

If it does, can you switch back to an older PHP version and see what happens?