From 08cbbc0b0f60642a93bf014a6c9b75c3828ee07b Mon Sep 17 00:00:00 2001
From: mdb <mdb@6335cc39-0255-0410-8fd6-9bcaacd3b74c>
Date: Mon, 8 Oct 2007 21:38:35 +0000
Subject: [PATCH] Per Sarah: only strip the hostname if we have reason to
 believe we have a hostname (foo.bar.com), prepend a "." to what appears to be
 a hostless domain (bar.com), and don't call setDomain() at all if we don't
 have someting that looks like a domain (localhost).

git-svn-id: https://samskivert.googlecode.com/svn/trunk@2231 6335cc39-0255-0410-8fd6-9bcaacd3b74c
---
 .../samskivert/servlet/util/CookieUtil.java   | 25 +++++++++++--------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/src/java/com/samskivert/servlet/util/CookieUtil.java b/src/java/com/samskivert/servlet/util/CookieUtil.java
index 0be501c3..b74bfbe7 100644
--- a/src/java/com/samskivert/servlet/util/CookieUtil.java
+++ b/src/java/com/samskivert/servlet/util/CookieUtil.java
@@ -47,8 +47,7 @@ public class CookieUtil
     }
 
     /**
-     * Get the value of the cookie for the cookie of the specified name,
-     * or null if not found.
+     * Get the value of the cookie for the cookie of the specified name, or null if not found.
      */
     public static String getCookieValue (HttpServletRequest req, String name)
     {
@@ -68,18 +67,24 @@ public class CookieUtil
     }
 
     /**
-     * Sets the domain of the specified cookie to the server name
-     * associated with the supplied request minus the hostname
-     * (ie. <code>www.samskivert.com</code> becomes
+     * Sets the domain of the specified cookie to the server name associated with the supplied
+     * request minus the hostname (ie. <code>www.samskivert.com</code> becomes
      * <code>.samskivert.com</code>).
      */
     public static void widenDomain (HttpServletRequest req, Cookie cookie)
     {
-        String domain = req.getServerName();
-        int didx = domain.indexOf(".");
-        if (didx != -1) {
-            domain = domain.substring(didx);
+        String server = req.getServerName();
+        int didx = server.indexOf(".");
+        // if no period was found (e.g. localhost) don't set the domain
+        if (didx == -1) {
+            return;
+        }
+        // if two or more periods are found (e.g. www.domain.com) strip up to the first one
+        if (server.indexOf(".", didx+1) != -1) {
+            cookie.setDomain(server.substring(didx));
+        } else {
+            // ...otherwise prepend a "." because we're seeing something like "domain.com"
+            cookie.setDomain("." + server);
         }
-        cookie.setDomain(domain);
     }
 }