mirror of
https://github.com/logicog/RTLPlayground.git
synced 2026-08-30 14:52:51 +08:00
d00f
3fd9cdfa7e
Root cause of the "browser login always bounces back with Wrong password! while curl works": scan_header() read the session id from a fixed offset into the Cookie header (p + 17), assuming "session=" is the first and only cookie. Browsers keep stale cookies for a long time - e.g. an "admin" cookie left over from this switch's VENDOR firmware - so the header can arrive as "Cookie: admin=..; session=..", the fixed offset then points into the admin value, authentication silently fails and every page bounces to login although the password had been accepted. curl sends only "session=", which is why command-line tests passed while a real browser (with that stale cookie) failed. - scan_header(): scan the Cookie header for the actual "session=" key (matched as "session" - is_word() requires a separator after the pattern and '=' is on its list, the first value byte is not). - is_word_x(): accept ';' as a terminating separator so the session value also matches when it is not the last cookie in the header. Verified on hardware end-to-end in a real browser WITH the stale "admin" cookie present: login -> index.html, all pages and JSON endpoints work.