-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On 03 Sep 2004, at 9:21 PM, John J Lee wrote:

> On Wed, 1 Sep 2004, alanp wrote:
> [...]
>>>    I know it. What I don't know is why people think they can set
>>> cookie
>>> that will be sent back to a third-party host... by whatever way -
>>> HTTP
>>> redirect, HTML pull, javascript...
>>
>> AFAIK the cookie & the redirected-to-host were the same beast. Perhaps
>> i messed up on the "path=" portion of the cookie :-(
>
> No, the path probably isn't your issue.  As far as cookie handling is
> concerned, a browser has no interest in whether or not two host names
> refer to a single host.  All that matters here is string comparisons on
> host names.

Now i know i really should read the http & cookie specs in depth this
time .

BTW, following the example in Oleg's earlier response, i added a
"Location:" header to my redirect & it seems to work  (for the two
browsers i tried anyway).  Now it test it on all browsers :-)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFBPBRVKJDmEytdZIcRAnN+AJ9XDPe7QDYFZd69NSwG5o0/sHkccwCfVGUe
MQpaPidNBOb98tkeVNWk130=
=1Vcy
-----END PGP SIGNATURE-----