Could not get cookie from another (parent) domain in Django

views:

431

answers:

+1 Q:

Could not get cookie from another (parent) domain in Django

Hi All!

I need to remove a cookie that was previously set for parent domain while browsing host at subdomain of the parent.

I.e., a cookie "xyz" was set for example.com, and I am trying to remove it on subdomain.example.com, using Django backend.

The request.COOKIES given to the view does not contain any cookies except those from subdomain.example.com, so I can't write just response.delete_cookie(...) in order to delete it.

It is possible to perform such deletion either in Python or Javascript?

+1 A:

The cookie was probably set with 'domain' parameter. Set the cookie to be accessible from all the subdomains of the domain the cookie is being set in.

I'm not the python guy, but my knowledge of http protocol shows that this might be the problem.

Eimantas 2010-01-11 16:30:43

> Set the cookie to be accessible from all the subdomains of the domain the cookie is being set in.What exactly do you mean? Yes, the cookie was set (as shown in Firebug) with domain=example.com. The problem is I almost have no possibility to influence on cookie setting (the code is written in PHP instead of Python, I have no access to its repository unless going through manager hierarchy etc.), so I am trying to find another solution.

Serge Tarkovski 2010-01-11 17:02:03

You can attempt to call delete_cookie even for a cookie you haven't been able to read. Django will output the relevant Set-Cookie headers to delete the cookie regardless. Naturally the domain and path you pass to delete_cookie must match the cookie you intend to delete.

However, if you haven't been able to read the cookie, it is likely there is another problem, which might prevent you deleting it. Are you sure the cookie from the parent domain was set with a domain=parentdomain.tld parameter? If not then it wouldn't be visible or deletable from the subdomain, except in IE due to that browser's bad handling of no-domain-specified cookies.

bobince 2010-01-11 16:54:16

The cookie from parent domain was set with domain=".example.com", according to Firebug. The first thing I've tried was to remove cookie using response.delete_cookie('xyz', domain='.example.com') with no effect.

Serge Tarkovski 2010-01-11 17:36:29

That should certainly have an effect from a subdomain of example.com, as long as there is no `path` also set on the cookie and it's not an https-only cookie... but then if it were, you'd also be getting that cookie at the server-side. Check it in Preferences->Privacy->Show Cookies.

bobince 2010-01-11 22:42:24

ansaurus

tags:

views:

answers:

Could not get cookie from another (parent) domain in Django

related questions