Skip to content
This repository has been archived by the owner on Nov 29, 2018. It is now read-only.

Delete cookies doesn't work #615

Closed
lukeis opened this issue Mar 2, 2016 · 31 comments
Closed

Delete cookies doesn't work #615

lukeis opened this issue Mar 2, 2016 · 31 comments

Comments

@lukeis
Copy link
Member

lukeis commented Mar 2, 2016

Originally reported on Google Code with ID 615

What steps will reproduce the problem?
1. Delete cookies command doesn't work
2. check if cookies exist in browser
3. write scripts: <tr>
    <td>deleteCookie</td>
    <td>OAID</td>
    <td>path=/, domain=www.123people.com, recurse=true</td>
</tr>
4. Execute
5. Cookie still exist


What is the expected output? What do you see instead?
expected output - cookie is deleted
actual ouput - command execute, but cookie still exist

What version of the product are you using? On what operating system?
Selenium IDe 1.07

Please provide any additional information below.


Reported by investectest on 2010-06-30 14:30:24

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

I could reproduce the problem, will investigate it some more.

Reported by Samit.Badle on 2010-06-30 18:40:13

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Hi,

I suspect that the cookie you are trying to delete is actually a server-side only (httponly)
cookie and cannot be deleted using Javascript. I have attached a test case to confirm
the same. Do you think you can first verify that the cookie you want to delete actually
exists, then load the test case and replace the deleteCookie command with the one you
want, execute the test case and give us the log output? 

Cheers,
Samit

Reported by Samit.Badle on 2010-07-02 13:46:17


- _Attachment: [deleteCookieFF.htm](https://storage.googleapis.com/google-code-attachments/selenium/issue-615/comment-2/deleteCookieFF.htm)_

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Hi,
I have a similar situation and I tested several times and could not get delete cookie
or delete cookie with wait to delete a cookie and i checked we do not have httponly
flag. 

Reported by rks0020 on 2010-09-21 16:17:53

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Hi,

Would you be able to provide some more details about your selenium and browser versions
and if possible the http header?

Cheers,
Samit

Reported by Samit.Badle on 2010-09-23 08:03:38

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Reported by Samit.Badle on 2010-11-30 09:44:35

  • Labels added: ide

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

I got this issue both IDE(1.0.8) and RC(2.0a7)
as the selenium RC server's log:
----------
13:42:11.701 INFO - Command request: deleteAllVisibleCookies[, ] on session b85cc414d7fa47f88e61ecd4be4ff438
13:42:11.739 INFO - Got result: OK on session b85cc414d7fa47f88e61ecd4be4ff438
----------
But actually ,it doesn't work.



Reported by jollychang on 2010-12-13 06:20:04

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Reported by simon.m.stewart on 2011-01-21 15:00:17

  • Labels added: Component-Core
  • Labels removed: ide

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Deletecookies doesn't work in my case.  Here's my situation.

In firefox, menu Tools, Options, Show cookies I see the following 4 cookies:

Name:      CTSESSID
Host:      concours.transcontinentalmedia.com
Path:     /

Name:     id
Host:     .doubleclick.net
Path:     /

Name:     OAVARS[ad495a0f] (the number in bracket always change)
Content:  a%3A3%3A%7Bs%3A8%3A%22b.... etc
Host:     greatcanadianmagazines.com
Path:     /


Name:     OAID
Host:     greatcanadianmagazines.com
Path:     /

Name:     UID
Host:     .scorecardresearch.com
Path:     /

---------
In Selenium IDE I wrote this:
Command       Target      Value

deleteCookie  CTSESSID    path=/, domain=concours.transcontinentalmedia.com
deleteCookie  id          path=/, domain=.doubleclick.net
deleteCookie  OAVARS      path=/, domain=greatcanadianmagazines.com, recurse=true
deleteCookie  OAID        path=/, domain=greatcanadianmagazines.com
deleteCookie  UID         path=/, domain=.scorescardresearch.com

then I ran the stript.

When I return to firefox, menu Tools, Options, Show cookies, I still see exactly the
same cookies!!

Question:  What is wrong with my script?

Reported by sjobinQA on 2011-04-25 14:14:58

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

issue confirmed in SIDE 1.2.0 / Fx 6.0.2

I also tried verifyEval window.document.cookie=""

Incidentally, I tried the same script in Firebug to no avail. It looks like Fx will
not allow the cookie to be deleted from outside of the window's js context (just a
wild guess).

Reported by jonwolski on 2011-09-19 21:14:59

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

I was able to reproduce this with IDE 1.2.0 and FF5.0.1

deleteAllVisibleCookies
deleteCookie

Both commands did not delete all cookies specified, including cookies that do NOT have
the httponly flag. You can test this on the yahoo.com home page.

Reported by kckil77 on 2011-09-22 17:16:14

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

I don't know if this is related or useful, but I noticed something interesting today.
deleteAllVisibleCookies and deleteCookie failed to delete a specific cookie causing
test to fail. I was working with Safari, and it seems like for some reason, Safari
was hiding cookie until around the very page it needed to use cookie at then you can
see it (with Web Inspector). So as workaround, I had to check for some condition that
let me know the cookie existed and should not be, then deleteCookie() manually at that
spot, then perform some actions to go back to area that performs cookie check to then
do the right thing when cookie doesn't exist.

So it seems like if you delete cookie at the wrong place, it doesn't delete cookie.

And I guess that's also why deleteAllVisibleCookies() fails, if it can't see the invisible
cookies that are not made visible yet.

Reported by mangaroo on 2012-05-18 02:52:33

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

On my comment #11, for deleting cookie @ wrong place, I meant if you delete cookie(s)
like at beginning of test or end of test (for test setup/teardown), it may still fail
as that's not right place because cookie may be "hidden" by browser for some reason
until the point where cookie is actually used.

Reported by mangaroo on 2012-05-18 02:55:25

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

MAGAROO - THANK YOU SO MUCH!!!!!

I've been fighting with this for a couple days now.  I'm using the selenium webdriver
for cucumber and I was going to try reverting to an older selenium web driver.  Thank's
to your post, I have a work-around.

My test logged in to my application using google oauth, the problem was that when I
wanted to sign out and sign in as another user (admin account), google retained the
cookies and didn't prompt for new authentication.  AND I COULDN'T DELETE THE COOKIES
because they weren't visible.

Now all I have to do to get this working is to visit googles homepage (which makes
the cookies visible) and then delete them before triggering the oauth to sign in as
the admin user.

THANKS AGAIN!

Reported by gposton1040 on 2012-05-19 04:38:22

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

It does not work for me still if you try to delete a HttpOnly cookie. Does not matter
when you execute this command. 

Reported by lonchik on 2012-08-27 07:13:24

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

On comment #15, which Selenium are you talking about Selenium RC/IDE, or Selenium 2/WebDriver?

Reading up on HttpOnly cookies: 
https://www.owasp.org/index.php/HttpOnly
http://en.wikipedia.org/wiki/HTTP_cookie#HttpOnly_cookie

It would appear they would not likely be supported in Selenium RC/IDE since those inject
javascript to control the browser, and javascript access to cookies not allowed for
HttpOnly.

But I think in theory it should be supported in WebDriver because that's a supposedly
native implementation to control browser. I suggest you check and see if it works under
WebDriver. That would be a legitimate issue if it didn't work under WebDriver.

Reported by mangaroo on 2012-08-27 17:49:13

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

The Firebug addon can delete an httpOnly cookie.

The Selenium IDE addon cannot delete an httpOnly cookie.

So, the theory presented in Comment 16 for Selenium IDE may not be valid.  I also regularly
use Selenium IDE to bypass browser cross-domain security safeguards in my automated
testing, so it appears that Selenium IDE doesn't merely inject javascript into the
browser.  More must be going on beneath the hood at a deeper level.

I conclude that Firebug and Selenium IDE must be using different methods to delete
cookies.

Perhaps Selenium IDE could use the same method that Firebug uses to delete httpOnly
cookies.

Reported by jimgkraai on 2012-11-07 21:52:58

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

So on comment 16, you mean to say that you use Selenium IDE for some manual testing
where automation is blocked? Or that you run the automated test via IDE than RC so
that you can manually bypass xdomain issues?

I do wonder whether RC uses same codebase as IDE though or not, and as such whether
delete HttpOnly cookie will fail or not.

It could be that the IDE deletes cookies by way of javascript and doesn't use javascript
for cross domain stuff that you are bypassing. No way to tell for sure unless you look
at the source code to see how the actual cookie deletion is done.

Understandable that Firebug may be different as browser extensions I believe aren't
restricted to just using javascript, in which case, yes, ideal to make IDE work like
Firebug for cookie deletion/management.

Reported by mangaroo on 2012-11-07 22:32:12

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

A continuation of comment 17 ...

in http://selenium.googlecode.com/svn/trunk/javascript/firefox-driver/js/firefoxDriver.js
<- search for deleteAllCookies
it appears that Selenium IDE is deleting a cookie via nsiCookieManager

and FireCookie addon for Firebug uses nsICookieManager2

https://code.google.com/p/firecookie/source/browse/trunk/chrome/content/firecookie/fireCookie.js
<- search text for "createCookie: function(cookie)"

see
https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsICookieManager2

Reported by jimgkraai on 2012-11-07 22:32:20

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

On comment 20, not sure if you are looking at the right source for Selenium IDE. The
branch you are looking at refers to FirefoxDriver which is Selenium 2/WebDriver, even
though the exact file you refer to is a javascript file.

Supposedly, I would think the correct file(s) to look for would be under here?

http://selenium.googlecode.com/svn/trunk/ide/

Reported by mangaroo on 2012-11-07 22:41:14

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

It's been a year since last activity on this bug. What is the status? What needs to
be done?

Reported by p.dobrogost on 2013-12-03 15:00:16

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Contrary to comment #20, it appears that firefoxDriver.js is using nsiCookieManager2
to create new cookies.

According to the MDN documentation, this is because that is where the delete functionality
is implemented:

https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsICookieManager
https://developer.mozilla.org/en-US/docs/XPCOM_Interface_Reference/nsICookieManager2

However, I agree with comment #22. This is still an issue. What can we do to work around
the httpOnly cookie issue?

Reported by largret on 2013-12-31 20:18:58

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

A work-around is provided here:

http://selenium.10932.n7.nabble.com/IEWebDriver-gives-quot-Cannot-delete-cookie-named-JSESSIONID-quot-with-IE7-td18823.html#a18918

Basically, create an empty cookie with the name you want to delete. This is kludgy
but it appears to work for me so far.

Reported by largret on 2014-01-02 13:46:08

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Delete cookies also does not works when you have the following setup:
xx.testenv.company.com/subsite
Then you have the session cookie stored with a Path attribute which has the value of
/subsite/
In this case selenium does not sees at all this session cookie.
Not for getting it and not for deleting.
Valid for the current latest Selenium 2.41.0 in Ruby and Java implementation as well.
Please check.

Reported by gangeld on 2014-05-26 08:17:29

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

This issue is related to Selenium Core and Selenium RC (not WebDriver)

Reported by barancev on 2014-05-26 08:37:22

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Does it have already a bug ticket?

Reported by gangeld on 2014-05-26 09:23:28

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Not sure, raise a new one and provide a reproduction scenario.

Reported by barancev on 2014-05-26 09:51:06

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

I have tried the DeleteAllCookiesAndWait method but it seems it is not working, after
a certain period of time the script moved due to timeout but it didnt help clear the
cookies.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head profile="http://selenium-ide.openqa.org/profiles/test-case">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<link rel="selenium.base" href="http://alpha.tigerdirect.com/" />
                <td>echo</td>
                <td></td>
                <td>Test Case for Retail Store</td>
</tr>
<tr>
                <td>deleteAllVisibleCookiesAndWait</td>
                <td></td>
                <td></td>
</tr>
<tr>
                <td>open</td>
                <td></td>
                <td></td>

Reported by amazingrahul on 2014-08-22 08:03:45

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Was comment #25 ever bugged?  We are currently suffering from this problem.  When we
delete cookies we're at this URL:

www.example.com/app/consumer/home/index

This deletes all cookies with path "/" or path "app/consumer/*".

However, we have other cookies with path "app/auth" and "app/cas" and those cookies
are not deleted.

Reported by csmalley@bloomhealthco.com on 2014-11-12 22:33:55

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Selenium RC is deprecated and the support of Selenium RC is discontinued.

Selenium team is not going to fix remaining issues in Selenium RC and we don't accept
new issue reports on Selenium RC.

On the other side, we continue to accept pull requests and patches from the community.

Reported by barancev on 2015-03-12 21:20:14

  • Status changed: WontFix

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Hi, I am using Selenium IDE 2.9.0. I am also facing the same issue. I could not delete
the cookies. Please find the details below,

My Script:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head profile="http://selenium-ide.openqa.org/profiles/test-case">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<link rel="selenium.base" href="http://localhost:8080/LabInABox/com.specsavers.liab.LabInABox/LabInABox.html"
/>
<title>New Test</title>
</head>
<body>
<table cellpadding="1" cellspacing="1" border="1">
<thead>
<tr><td rowspan="1" colspan="3">New Test</td></tr>
</thead><tbody>
<tr>
    <td>open</td>
    <td>https://account.jetbrains.com/a/elbts6</td>
    <td></td>
</tr>
<tr>
    <td>pause</td>
    <td>100</td>
    <td></td>
</tr>
<tr>
    <td>deleteCookie</td>
    <td>JSESSIONID</td>
    <td>"path=/, domain=account.jetbrains.com, recurse=true"</td>
</tr>
<tr>
    <td>deleteCookie</td>
    <td>timeZoneOffset</td>
    <td>"path=/, domain=account.jetbrains.com, recurse=true"</td>
</tr>
<tr>
    <td>deleteCookie</td>
    <td>JBA</td>
    <td>"path=/, domain=account.jetbrains.com, recurse=true"</td>
</tr>
<tr>
    <td>deleteCookie</td>
    <td>timeZoneOffset</td>
    <td>"path=/a/, domain=account.jetbrains.com, recurse=true"</td>
</tr>

</tbody></table>
</body>
</html>

I ran the attachement deleteCookieFF.htm.. Plz find the log below,

[info] Playing test case Untitled
[info] Executing: |storeEval | this.browserbot.getDocument().location.href | ccc |
[info] script is: this.browserbot.getDocument().location.href
[info] Executing: |echo | ${ccc} | |
[info] echo: https://account.jetbrains.com/login
[info] Executing: |storeCookie | ccc | |
[info] Executing: |echo | ${ccc} | |
[info] echo:
[info] Executing: |deleteCookie | NID | domain=www.google.com, path=/ |
[info] Executing: |storeCookie | aaa | |
[info] Executing: |echo | ${aaa} | |
[info] echo:
[info] Test case passed 

Please let me know a way to clear the cache and cookie using Selenium IDE.

Thanks

Reported by kavitha.rajendran82 on 2015-03-31 07:17:40


- _Attachment: Cookie List.PNG
![Cookie List.PNG](https://storage.googleapis.com/google-code-attachments/selenium/issue-615/comment-32/Cookie List.PNG)_

@lukeis
Copy link
Member Author

lukeis commented Mar 2, 2016

Reported by luke.semerau on 2015-09-17 17:49:39

  • Labels added: Restrict-AddIssueComment-Commit

@lukeis lukeis closed this as completed Mar 2, 2016
@SeleniumHQ SeleniumHQ locked and limited conversation to collaborators Mar 4, 2016
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant