PRB: Image Uploader for Java looses HTTP-only cookies

Overview

When you try to upload files with Image Uploader in Firefox 2.0.0.5 or later you can find that your session cookies are lost.

This problem is related to:

• Image Uploader for Java (any version);

• Mozilla Firefox 2.0.0.5 or later;

• HTTP-only cookies usage.

Reason

From version 2.0.0.5, Firefox supports HTTP-only cookies and makes it impossible to read them using JavaScript. It increases security and prevents your site from cross-site scripting attacks. In particular such cookies are used in standard ASP.NET authentication mechanism.

When Java version of Image Uploader prepares a POST request before uploading it to the server, it extracts all cookies which are downloaded along with the page that hosts Image Uploader. To get cookie, Image Uploader uses the same object model as you do in JavaScript (as if you use document.cookie).

However the browser does not allow Image Uploader to get HTTP-only cookies. That's why when you post files to the server, it does not get such cookies. In particular it means that ASP.NET is not able to identify the session properly, as well as other undesirable effects.

You may wonder why it worked earlier. The point is that earlier versions of Firefox (as well as other non-IE browsers) interpreted HTTP-only cookies in the same manner as traditional scriptable cookies. It was possible to get access to them through DOM, so Image Uploader did not loose them.

Resolution

To avoid this problem you should use new AddCookie(String) method, which appears in Image Uploader Dual build 4.5.50.0 (Java version version number is 2.5.50.0). If you have earlier version, you should download the latest release from the product download page. This method explicitly attaches a cookie to the upload request.

Note

Although you can send traditional cookies this way, you should use it solely for HTTP-only cookies. Also, you should not use it for ActiveX version.

This method can be used in the BeforeUpload event handler. What you need is to pass to this method a cookie name-value pair as a string, separated with '=' character. The code snippet before demonstrates how to do it. Note, this sample is for ASP.NET only.

<script language="javascript">
function ImageUploader1_BeforeUpload(){
getImageUploader("ImageUploader").AddCookie('<%=FormsAuthentication.FormsCookieName %>=<%= Request.Cookies[FormsAuthentication.FormsCookieName].Value %>');
}
var iu = new ImageUploaderWriter("ImageUploader", 770, 500);
iu.activeXControlEnabled = false;
iu.javaAppletEnabled = true;

//For Java applet we specify only directory with JAR files
iu.javaAppletCodeBase = "./";
iu.javaAppletCached = false;
iu.javaAppletVersion = "2.5.50.0";
iu.showNonemptyResponse = "off";

//Other parameters…
   		    
//Configure URL files are uploaded to.
iu.addParam("Action", "upload.aspx");
iu.addEventListener("BeforeUpload", "ImageUploader1_BeforeUpload");
iu.writeHtml();
</script> 

Edited by user Friday, December 18, 2009 7:48:56 PM(UTC)  | Reason: Not specified

function ImageUploader1_BeforeUpload(){
  var iu = getImageUploader("ImageUploader1");
  if (iu.AddCookie)
    iu.AddCookie('<%=FormsAuthentication.FormsCookieName %>=<%= Request.Cookies[FormsAuthentication.FormsCookieName].Value %>');
}

In such a way, iu.AddCookie will not be called in the case the ActiveX is used.

Edited by user Friday, December 18, 2009 7:49:33 PM(UTC)  | Reason: Not specified

"<%=FormsAuthentication.FormsCookieName %>=<%= Request.Cookies[FormsAuthentication.FormsCookieName].Value %>"?

My Image Uploader is version 5.0.40

I think it could be helpful in some cases, because AddCookie method question is still one of the most wanted.

P.S. There is readme.txt inside attachment with additional information.

File Attachment(s):

AddCookieSnippet.zip (11kb) downloaded 180 time(s).

It falls over in FF with the following error:

BC30034: Bracketed identifier is missing closing ']'.

and highlights the line below (Marked)

Everything works fine in IE (without the fix for redirect), so it is def soemthing to do with this line.

Any help greatly appreciated.

regards

Andrew

<script type="text/javascript">
//Create JavaScript object that will embed Image Uploader to the page.
var iu = new ImageUploaderWriter("ImageUploader1", 650, 400);

function ImageUploader_BeforeUpload()
            {
                // Here we are adding Authentication cookies manually
	            
// ********** ERROR LINE getImageUploader("ImageUploader").AddCookie('<%=FormsAuthentication.FormsCookieName %>=<%= Request.Cookies[FormsAuthentication.FormsCookieName].Value %>;');
// ********** ERROR LINE 
            }

//For ActiveX control full path to CAB file (including file name) should be specified.
iu.activeXControlCodeBase = "gallery/ImageUploader5.cab";
iu.activeXControlVersion = "5,0,15,0";

//For Java applet only path to directory with JAR files should be specified (without file name).
iu.javaAppletJarFileName = "ImageUploader5.jar";
iu.javaAppletCodeBase = "gallery/";
iu.javaAppletCached = true;
iu.javaAppletVersion = "5.0.15.0";

iu.showNonemptyResponse = "off";

iu.addParam("RedirectUrl", "photo-album-edit.aspx");

//Configure appearance and behaviour.
iu.addParam("PaneLayout", "TwoPanes");
iu.addParam("ShowDebugWindow", "true");
iu.addParam("ShowDescriptions", "false");
iu.addParam("BackgroundColor", "#ffffff");

//Configure Image Uploader to rotate photos automatically 
//according to the orientation stored in EXIF metadata.
iu.addParam("AllowAutoRotate", "true");

//Append the form with total file size to the upload.
iu.addParam("AdditionalFormName", "Form1");

//Configure file mask to upload JPEG images only.
iu.addParam("FileMask", "*.jpeg;*.jpg;*.jpe;*.gif");

//Set image size restrictions.
//iu.addParam("MinImageWidth", "360");
//iu.addParam("MinImageHeight", "360");

//Exclude the source file from upload because only 
//resized versions of the photo will be sent.
iu.addParam("UploadSourceFile", "false");

//Configure URL files are uploaded to.
iu.addParam("Action", "photo-upload.aspx");
            if ("Java" == iu.getControlType())
            {
                iu.addEventListener("BeforeUpload", "ImageUploader_BeforeUpload");
            }


//Add event handlers.
iu.addEventListener("UploadFileCountChange", "ImageUploader_UploadFileCountChange");
iu.addEventListener("Progress", "ImageUploader_Progress");

//Tell Image Uploader writer object to generate all necessary HTML code to embed 
//Image Uploader to the page.
iu.writeHtml();

	</script>

Edited by user Friday, December 18, 2009 7:51:01 PM(UTC)  | Reason: Not specified

getImageUploader("ImageUploader").AddCookie('<%=FormsAuthentication.FormsCookieName %>=<%= Request.Cookies[FormsAuthentication.FormsCookieName].Value %>;');

go in EXACTLY like this - or do I need to make some changes - this is where the errors are coming from.

I am using vs2005 on .net2.0.

Thanks for the help

However, I am still getting the error "The server attempted to redirect you but server redirects are not supported".

Your code snippet worked fine but it doesn't have the equivalent of my:

iu.addParam("RedirectUrl", "photo-album-edit.aspx");

line in which I guess is what is causing the problem??

Everything works fine in IE, just firefox 2.0.0.14

Any further help would be greatly appreciated.

regards

Andrew

Currently in ie, the users go from a management page to a photo selection page, press upload then go back to the management page automatically (through a response.redirect on the upload page) - is this not possible now?

Hi,

i am using ASP.NET 2.0 and using windows authentication not the FormsAuthentication.

Please suggest what string should i use in place of

function ImageUploader1_BeforeUpload()

{

getImageUploader("ImageUploader1").AddCookie('<%=FormsAuthentication.FormsCookieName %>=<%= Request.Cookies[FormsAuthentication.FormsCookieName].Value %>');

}

As using the above code i get an error :

"Object reference not set to an instance of an object."

Please suggest

Thanks

Hi Eugene,

I am using Image Uploader 5.1.10.0 Dual version but it does not work on Mozilla/Firefox

It shows the error messsage :

"The server attempted to redirect you, but server redirects are not supported".

Please suggest what string should i use in place of that function

ImageUploader1_BeforeUpload()

{

getImageUploader("ImageUploader1").AddCookie('<%=FormsAuthentication.FormsCookieName %>=<%= Request.Cookies[FormsAuthentication.FormsCookieName].Value %>');

}

as the <authentication mode="Windows" /> in my project.

Thanks