From: David Heinemeier Hansson <david@...>
Date: 2003-10-31T01:38:38+09:00
Subject: Disregarding cookies in 302 requests with CGI.rb under mod_ruby

It seems that cookies set with CGI#header are thrown away when using 
mod_ruby. This piece of code:

header({
  "Status" => "302 Moved",
  "location" => "http://37signals.misto/tests/file_upload.rbx",
  "cookie" => [
  CGI::Cookie::new(
     "name" => "session_key",
     "value" => "123"
) ]
})

Produces this under normal Ruby CGI:

HTTP/1.1 302 Moved
Date: Wed, 29 Oct 2003 17:01:03 GMT
Server: Apache/1.3.28 (Darwin) mod_ruby/1.0.7 Ruby/1.8.0 PHP/4.3.2
Set-Cookie: session_key=123; path=/tests/
location: http://37signals.misto/tests/file_upload.rbx
Content-Type: text/html

And this under mod_ruby (1.0.7):

HTTP/1.1 302 Moved
Date: Wed, 29 Oct 2003 17:01:06 GMT
Server: Apache/1.3.28 (Darwin) mod_ruby/1.0.7 Ruby/1.8.0 PHP/4.3.2
Location: http://37signals.misto/tests/file_upload.rbx
Content-Type: text/html; charset=iso-8859-1

Aside from the missing Set-Cookie directive, the charset is also being 
set under mod_ruby. Is it possible to alter this behaviour? I don't 
care much about the charset, but I would indeed like to be able to send 
cookies with 302-responses.

The objective for doing this is that I'd like the following use-case 
implemented:

1. Unauthenticated user (UU) attempts to access page A
2. UU is directed to a login screen
3. UU logs in and is redirected to page A

Hence, I need to record the URL of page A and store that result in a 
cookie while I forward the user to the login screen. This could also be 
done with "login_screen?return_to=url", but I'd rather not do it like 
that.
--
David Heinemeier Hansson.
http://www.loudthinking.com/ -- Broadcasting Brain