I've recently been handed administration of a system that is built on perl CGI scripts and MySQL. Unfortunately, I am no perl guru and the system is not functioning as it did on the old server.

The scripts are based of off CGI.pm, but I don't think that they use it directly. Whatever the case, whenever a user logs into a webpage their username and password are authenticated and a cookie is sent to their system. They are then sent to a redirect screen while the cookie is verified. For some reason, the cookie is never verified and the user is told that their cookie has expired or doesn't exist and to check the settings on their browser. However, I can see the cookie on the local machine and the session key info it stores matches up with the info on the server.

This problem can be bypassed at the redirect screen by clicking a link that forces the redirect and modifies the cookie. After bypassing it this way, I can then log in and out normally without forcing the redirect.

Based on the error message generated, I've narrowed down the offending code to these lines:

$skey = $query->cookie(-name=>'skey');
unless ($skey) {
if ($query->referer =~ /login/) {
t_error("session_key_login");
}
else {
t_error("session_key_expired");
}
}

What I'm getting is the "session_key_expired" error, so the quey->cookie seems to be failing.

Has anyone here ever had a problem similar to this? I've replicated it on multplie platforms and browsers and the behavior is consistent. I'm beginning to reach my wits end.

How is the cookie being set?....just because you can see it doesn't necessarily mean it is setting properly.

You can change:

$skey = $query->cookie(-name=>'skey');

to:

$skey = $query->cookie('skey');

...also.

You might want to make the referer checking stricter too as I could refer myself from any url with "login" in and it would let me in.

I believe that this is the code where the initial cookie is set:

$cookie = $query->cookie(-name=>"skey", -value=>$skey,
-expires=>"+30m",
-path=>"/cgi-bin/ETD-submit");
print "Set-Cookie: $cookie\n";

I tried the change that you suggested and it seemed to cause the initial login to fail and then to work correctly on successive attempts. After changing the script to it's original form so that I could verify that this behavior was not present before, my logins worked flawlessly each time. Intermittent problems == insanity.

Make sure you clear all your cookies and close your browser before testing.

I was clearing my cookies, but not closing my browser, so....I'm back to the first login attempt failing and then successive attempts working. ????