View Issue Details

WikiJump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0036819mantisbtauthenticationpublic2026-01-07 19:562026-01-09 13:26
ReporterThecaTTony Assigned To 
PrioritynormalSeveritymajorReproducibilityalways
Status confirmedResolutionopen 
PlatformlinuxOSubuntuOS Version24.04 lts
Product Version2.28.0 
Summary0036819: Secure cookies are rejected by the browser
Description

After updating to version 2.28.0 and having the cookie prefix set to:

$g_cookie_prefix = '__Host-BPMS';

The browser rejects cookies because they are not being served correctly by (I think) mantisbt.

If I revert the update, changing the mantisbt link to the previous version in the web server directory, everything works correctly.

Steps To Reproduce

Update to 2.28.0 with "__Host-SOMETHING" cookie prefix and try to login or (if already logged) try to change project.

Additional Information

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#cookie_prefixes

Secure-: Cookies with names starting with Secure- must be set with the Secure attribute by a secure page (HTTPS).
Host-: Cookies with names starting with Host- must be set with the Secure attribute by a secure page (HTTPS). In addition, they must not have a Domain attribute specified, and the Path attribute must be set to /. This guarantees that such cookies are only sent to the host that set them, and not to any other host on the domain. It also guarantees that they are set host-wide and cannot be overridden on any path on that host. This combination yields a cookie that is as close as can be to treating the origin as a security boundary.

TagsNo tags attached.
Attached Files
mantis-cookie.png (53,639 bytes)   
mantis-cookie.png (53,639 bytes)   

Relationships

Relationship GraphDependency Graph
related to 0035424 closedcommunity Use new string_build_query() API function 

Activities

ThecaTTony

ThecaTTony

2026-01-07 21:17

reporter   ~0070707

I forgot to mention that the cookies in the attached screenshot were set using version 2.27.3, while I was testing. I was unable to login with version 2.28.0, all I got was the message: "Your browser either does not know how to handle cookies, or refuses to handle them."
dregad

dregad

2026-01-09 13:23

developer   ~0070711

Hello @ThecaTTony, thanks for the report.

I was not aware of this cookie prefix feature, learn something new everyday...

Confirming the bug, as I was able to reproduce the problem. According to git bisect, the regression was introduced by MantisBT master 5393a566 as part of fix for 0035424.