2

It's usual that WordPress stores comment author name and email in the user's browser cookies, so next time the visitor has to comment, they have their name and email already filled in automatically.

My question is:

Is it possible for WordPress to store a visitor's comment cookies on two computers at different locations, but probably using the same ISP?

I'm asking this because I've seen someone else's name and email address stored in the comment form of a WordPress powered blog I was reading. My computer is password protected and nobody used it except me. And this happened not once, not twice but many times (every time a random unknown name and email). Even I've seen a "Your comment is waiting moderation" message.

And since I believed every browser maintains it's cookies for its own, this behavior is strange to me.

__

EDIT:

Property    Value
Name        comment_author_b4f88879dbf70af24980db38c9197684
Value       Emma
Host        example.tld
Path        /
Expires     Fri, 20 Dec 2013 12:56:16 GMT
Secure      No
HttpOnly    No

Name        comment_author_email_b4f88879dbf70af24980db38c9197684
Value       email%40server.co.uk
Host        example.tld
Path        /
Expires     Fri, 20 Dec 2013 12:56:16 GMT
Secure      No
HttpOnly    No
Improve this question
11
  • +1, but I've never seen this before. Could you show us some example from your dev tools (I mean the cookie and it's values).
    – kaiser
    Jan 7, 2013 at 7:37
  • 1
    @kaiser do you mean cookie property and its value? See my edit in the above question.
    – Muhannad
    Jan 7, 2013 at 7:42
  • Yeah, those cookies that seem to magically appear and it's values.
    – kaiser
    Jan 7, 2013 at 7:43
  • 1
    @kaiser: I edited my question.
    – Muhannad
    Jan 7, 2013 at 7:49
  • Very kool - if all users would be like that :) One more question: Could you replace that with a real domain, so we could try it ourself? As I said, I've never seen that happening before.
    – kaiser
    Jan 7, 2013 at 7:51

1 Answer 1

Reset to default
4

The cookies are fine.

enter image description here

The secret is caching. The blog owner has set up a server side output caching that doesn’t stop when someone sends as cookie. It should – as you can see, because caching pages with personal data is … odd.

Lesson: Don’t cache personalized output.

Improve this answer
1
  • Thanks toscho. The site is cached by the host provider as it seems.
    – Muhannad
    Jan 7, 2013 at 12:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.