Question

I´m currently developing an application on Android, using App Engine as a backend. Since there´s some heavy parsing going on, I sometimes need to pass session cookies from the android device to the server, in order to be authenticated when parsing the response data.

The code below is from server side, where I put the Cookie(s) that is passed from my android device in the server HttpUrlConnection object. Now to my issue.

I´ve been having huge problems with not being authenticated even though I pass a valid session cookie to the server. After a couple of days of debugging, it seems like I found the issue today, but I have no clue on how to fix this.

Using Microsoft network monitor, I can see that SOMETIMES when I make the request from the server, but not always, there´s a second cookie in the request, BESIDES the one that I have put in the HttpUrlConnection. This seems to confuse the the 3rd party server, which responds with a Set-cookie, rather than letting me access the secure page.

The cookies look like this:

The cookie that I set
Cookie:  PHPSESSID=q5r4uon05a32vhs29cd65sarv6

The second cookie, that just "appears" when I make the request
Cookie:  $Version=0; PHPSESSID=hb94i7vopft13uaaob837lf3b0; $Path=/

So, what is this version 0 cookie, and how can I make sure that it is not passed in my request?

ArrayList<HashMap<String, String>> fillMaps = new ArrayList<HashMap<String, String>>();
URL page = null;
Scanner scanner = null;
Session session = null;
HttpURLConnection connection = null;
try {
    link = link.replace("&amp;", "&");
    page = new URL(FS_PARTIAL_SESSION_URL + link);


    StringBuilder sb = new StringBuilder();
    Iterator<Cookie> cooks = cookies.iterator();
    while(cooks.hasNext()) {
        Cookie cookie = cooks.next();
        sb.append(cookie.getName()+"="+cookie.getValue());
        if (cooks.hasNext()) {
            sb.append(";");
        }
    }

    connection = (HttpURLConnection) page.openConnection();
    connection.setRequestProperty("Cookie", sb.toString());
    scanner = new Scanner(connection.getInputStream());

} catch (MalformedURLException e) {
    log.log(Level.SEVERE, e.getMessage(), e);
} catch (IOException e) {
    log.log(Level.SEVERE, e.getMessage(), e);
}
finally {
    connection.disconnect();
}

Answer 1

I finally solved this by creating my own “version 0” cookie. When doing so it seems like the second cookie doesn´t get created, or atleast my own cookie gets picked up instead. So in my while loop, the code now looks like this:

Cookie cookie = cooks.next();
sb.append("$Version=0; ");
sb.append(cookie.getName()+"="+cookie.getValue());
if (cooks.hasNext()) {
    sb.append(";");
}
sb.append("; $Path=/");