Cookie Recipes

[Bruce - PhosphorMedia]

I have a cookie script that WAS working, pulling a stored value out quite nicely (voucher). However, its suddenly stopped. Now, when just evaluating s.http_cookie, I only get two values:

mm5-S-basket-id=05abff9112b1f5a68b5bc609633b15c1; htscallerid=0e8daeb745f1c276e680cab162a93800

Yet, in the browser's (FF) information, I see 5

mm5-S-basket-id
htscallerid
voucher
mm5-admin-session
mm5-S-basket-id

and not sure why FF shows the basket id twice...thoughts?

[titus]

Re: Cookie Recipes

How are you generating your cookies? Try setting them via headers if you're currently setting them from <meta> elements.

Also, check the path on the FF

mm5-S-basket-id

cookies. I'm pretty sure that they're set to two different places (maybe '/' and '/mm5/' or something). Also, it might be something hard-coded in there, like "mm5" instead of allowing for something like "Merchant2" or "Merchant5".

Also, check out SetCookie, in the LSK (lib/util_public.mv). That shows how Miva is now setting their cookies. I've set cookies by calling that before without a hitch.

[RayYates]

Re: Cookie Recipes

Hi Bruce

Merchants cookie API uses two calls. The first appends the cookie into the global variable structure g.Output_Cookies. The second actually writes the cookies. The advantage to using the API is that 1) it removes the complexity. 2) it avoids conflicts with other modules that implement their own cookie functions.

<MvASSIGN NAME = "l.void" VALUE="{ [ g.Module_Library_Utilities ].SetCookie( g.Output_Cookies, l.name, l.value, l.domain, l.expires, l.path, l.secure ) }">
<MvASSIGN NAME = "l.void" VALUE = "{ [ g.Module_Library_Utilities ].OutputCookies( g.Output_Cookies ) }">

If your running on MM older than 5.7, copy the functions into your module.

[Bruce - PhosphorMedia]

Re: Cookie Recipes

Thanks Ray...is there a place we could have API examples posted and archived? (sort of like user annotations on Mivascript.org).

[wcw]

Re: Cookie Recipes

I am seeing some cookie weirdness too. You mentioned seeing htscallerid as one of two cookies. That cookie has been around since the last millennium. I have it and several other stores I looked at have it. They were updated too, as they are set to expire 1 year from now. However, I have found two stores that I recently looked at and they do not have that cookie. What's up with that? Why would some stores set and update that cookie and not others? How can we have a non-merchant application and keep track of the flow if the htscallerid is no longer reliable? Is that a bug in merchant or in the engine?

[nottheusual1]

Re: Cookie Recipes

htscallerid is a bugaboo for PCI certification for some of these supposed scanning services. It can be controlled from the miva.conf file.

Look at the second post:

http://extranet.mivamerchant.com/for...ht=htscallerid

Earliest I read because of problem with McAjoke:

http://extranet.mivamerchant.com/for...ht=htscallerid

[burch]

Re: Cookie Recipes

Since PR7 we have been advising hosts to disable htscallerid due to the PCI scanner issues and Miva Merchant has attempted to suppress the htscallerid cookie (if it's enabled) for the same reason.

Modules can set their own cookies using the SetCookie and OutputCookies functions in util.mvc. Non-merchant scripts can output a Set-Cookie header using miva_output_header.

[Scott McCollough]

Re: Cookie Recipes

Does this mean that s.callerid may be removed in some future version of the engine? Should non-Merchant scripts start migrating away from using this built-in variable and instead force our own cookies? Just to be on the safe side.

[wcw]

Re: Cookie Recipes

I'd like to see the cookie kept but make it follow the rules these scan agencies are enforcing, e.g. only set it in non-secure mode. Otherwise we are going to have a free-for-all of various applications setting different cookies for the sole purpose of tracking on the site. Viewing the cookies in the browser tools is going to lead some visitors to question why so many different cookies that appear to be simple session ids.