Description: ------------ Firefox adds the current working dir by default for setcookie(). In Auth.php (L.838 & 916) the setcookie does not add a path. the cookie is available only in the working dir that was in effect during the setcookie process. I made a hotfix for me but this let the cookie be available for the entire domain: setcookie('authchallenge', $this->session['challengecookie'],time()+$this->idle,"/"); Test script: --------------- Must have an Auth powered Application with advanced security enabled and an Auth check. Then, change dir and re-check Expected result: ---------------- no mismatch between $this->session['challengecookieold'] and $this->cookie['authchallenge'] Actual result: -------------- Security Breach. Challenge Cookie mismatch. (there is no cookie for the new working dir)

I second this request. If I am to use Auth on an entire system, it is logical that I will have several pages spread through sub-directories (as I do), any of which could trigger the login dialog.

This bug has been fixed in CVS. If this was a documentation problem, the fix will appear on pear.php.net by the end of next Sunday (CET). If this was a problem with the pear.php.net website, the change should be live shortly. Otherwise, the fix will appear in the package's next release. Thank you for the report and for helping us make PEAR better. The advanced security cookie now uses the same settings as the PHP Session cookie.