1

With unknown reason, the login form fails to work in Safari ( from 5.1.x to latest version ). Works with other browsers though.

Full code ( the page is index.php )

<?php
ini_set('display_errors', '1');
$err = '';
if(isset($_POST['action']) && $_POST['action'] == 'login') {
    require_once('require_once.php');
    $ans = Core::Authenticate($_POST['txt_user'], $_POST['txt_pass']);
    if($ans) {
        session_set_cookie_params(3600, domain_path);
        session_start();
        $_SESSION['login_key'] = 'A COMPLEX LOGIC';
        header('Location: console.php');
        exit;
    } else {
        $err = 'Invalid Username / Password';
    }
}
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <title>Login</title>
    <link rel="stylesheet" type="text/css" href="css/style.css" />
</head>
<body>
    <div id="login_wrapper">
        <form action="index.php" method="post">
        <input type="hidden" name="action" value="login" />
        <h1>Welcome</h1>
    <?php
    if($err != '') {
        echo '<p>Error: ' . $err . '</p>' . PHP_EOL;
    }
    ?>
                <table class="tbl_login">
            <tr>
                <td>Username</td>
                <td><input type="text" name="txt_user" /></td>
            </tr>
            <tr>
                <td>Password</td>
                <td><input type="password" name="txt_pass" /></td>
            </tr>
            <tr>
                <td>&nbsp;</td>
                <td><button>Login</button></td>
            </tr>
        </table>
        </form>
    </div>
</body>
</html>

Core::Authenticate is a function that returns true if credentials matched.

require_once.php contains other required files such as config file, DB library, etc.

domin_path is the absolute path of the script, defined in global scope.

I don't think it's server-side error, as other browsers ( Chrome, IE, Firefox ) work.

I suspect it is due to <button> tag, but when I look up the documents ( from Safari HTML Reference and MDN ), button tag without type attribute is supported since Safari 1.0. Therefore I tried to change it to <input type="submit" value="Login" />, but still, Safari refuses to work (redirects to same page without any message).

What else did I mislook ?

Note: No Issues detected / displayed in Safari. No console message either. The page passed W3C HTML Validation too.

Raptor
  • 53,206
  • 45
  • 230
  • 366

1 Answers1

5

Finally found out the reason why Safari can't submit the form.

Somehow the domain_path is not set correctly . It does not contain a leading /. After correcting the domain path, the function session_set_cookie_params() works correctly.

But why other browsers are working fine?

Raptor
  • 53,206
  • 45
  • 230
  • 366
  • Check this answer if you create the cookie with javascript: http://stackoverflow.com/a/5671466/1136132 – joseantgv Sep 29 '15 at 17:21
  • nice reference, but the answer you're referring to is not Safari-specific. well, maybe it's fixed after these 2 years. let me retry the scenario later. – Raptor Sep 30 '15 at 02:06
  • I had this problem with Safari (version 5.1.7 - last Windows stable version) just yesterday, so it has not been fixed yet! And your solution works perfectly :) – joseantgv Sep 30 '15 at 06:38