3

When I access nadex.com quotes, Firebug tells me I send these cookies (but it's really all one line):

JSESSIONID=Qk3lNyhpQCpGpfx4bghpJLd2ML90tNx3lKvpvPLcvdmJyGRGztH5!1308128606!-757\
827124; bhCookieSess=1; bhCookiePerm=1; IGFOREXCOOKIE=; LS__LSEngine_S=exist_13\
02897154477; LS__LSEngine_K=SHARE_SESSION; LS__https://demo-mdp.nadex.com=1; LS\
__LSEngine=73; iconStateSetting=/dealing/pd/cfd/login/loginUser.htm?iconsEnable\
d=true; homeUrl=https://demo.nadex.com/content/sites/ndx/en_US/; showDmaHelp=fa\
lse 

and Firefox's "Edit/Preferences/Privacy/remove individual cookies" seems to agree.

However, when I look at cookies.sql, some cookies above don't show up:

cp ~/.mozilla/firefox/xxxxxxxx.default/cookies.sqlite /tmp && \
echo "SELECT name FROM moz_cookies;" | sqlite3 /tmp/cookies.sqlite |\
sort | uniq 

(note that I must "cp" since the original db is locked by Firefox).

The result's ugly + unhelpful, but I specifically noted these values do NOT appear even though I'd expect them to:

  • JSESSIONID (probably the most important one)
  • homeURL
  • showDmaHelp
  • possibly others

How can I find these "hidden" cookies? I'm writing a perl/curl script to download data, but it doesn't work w/o the JSESSIONID cookie (and handcopying from Firebug isn't automatic enough, plus JSESSIONID changes often)

EDIT (too long/unwieldy for a comment): @Lekensteyn Thanks for the GM script! It doesn't update webappsstore.sqlite when I visit nadex.com and login, but it DOES update sessionstore.js, which contains:

{"host":"www.nadex.com","value":"3x0LNpvGDHQq\
xls7FxbqtJ2pFlL0gSyk9YvBkPs09r4yvQyZDMWs!-1593496027!1301994507","path":"/price\
stream","name":"JSESSIONID"}

all on one line (in fact, the entire file is a single line).

However, I haven't yet checked to see if that has anything to do w/ the GM script, or is something that happens anyway. At the very least, it gives me a new place to dig.

2
  • Hopefully, you've not put a sensible cookie in your question.
    – Lekensteyn
    Apr 15, 2011 at 20:15
  • I did, but it's short-lived and a demo account.
    – user11553
    Apr 16, 2011 at 13:09

2 Answers 2

1

I suspect that Firefox does not update the cookies.sqlite file directly for data integrity and performance reasons. Rather, it temporary stores the data in cookies.sqlite-journal (Firefox 3.x). Because the session cookies changes frequently, it is reasonable that the cookies are not present in the cookies.sqlite file. When Firefox is closed, the changes to cookies.sqlite are applied.


A workaround is available using a Greasemonkey script.

  1. Install the Greasemonkey add-on.
  2. Restart Firefox. Meanwhile, save the next text as "jsessionid.user.js".

    // ==UserScript==
    // @name           JSESSIONID to localStorage
    // @namespace      [email protected]
    // @description    Saves the JSESSIONID cookie in localStorage
    // @include        https://demo.nadex.com/dealing/pd/cfd/security*
    // ==/UserScript==
    (function() {
        var sessid = document.cookie.match(/JSESSIONID=([^;]+)/);
        if (sessid) {
            var oldSID = localStorage.JSESSIONID;
            if (sessid != oldSID) localStorage.JSESSIONID = sessid[1];
        }
    })();
    

    This should retrieve the session cookie right after login and store using HTML5 Storage if the session ID is different than the previously saved one. If you need to make the script save the session ID earlier, you need to modify the @include line to something like https://demo.nadex.com/*. I've noticed that no session ID is sent over HTTP, just HTTPS.

  3. Open the jsessionid.user.js file in Firefox (or drop it into Firefox). You'll be prompted on installing it. Accept it.
  4. In Bash, use something like:

    sessid=$(sqlite3 ~/.mozilla/firefox/xxx.xxx/webappsstore.sqlite "SELECT \
     value FROM webappsstore2 WHERE key='JSESSIONID' AND secure='1' \
     AND host LIKE 'moc.xedan.%' LIMIT 1;")
    

    moc.xedan. is a part of the domain in reverse order.

For debugging, you can use the next bookmarklet:

javascript:alert("JSESSIONID=" + localStorage.JSESSIONID);

It'll display null if there is no such ID found. Note that it matters whether you execute it on https://demo.nadex.com or http://demo.nadex.com. This bookmarklet can be pasted in the location bar directly.

4
  • That makes sense. I've seen sqlite do that with other dbs when it's in the process of updating something, but hasn't finished (normally, it's inside a transaction). What's the magic sqlite command that glues together foo.db and foo-journal.db, so I can see its current contents? As you know, foo-journal.db is not an sqlite db.
    – user11553
    Apr 16, 2011 at 13:10
  • @barrycarter: I've just checked it myself and it looks like Firefox keeps the session cookie in the memory, where changes in the HTML5 Storage data would be visible immediately in webappsstore.sqlite. You could create a GreaseMonkey script that stores the cookies contents in localStorage (or just the data you need, JSESSIONID?). Then, instead of accessing the cookies.sqlite file, you woudld have to look in webappsstore.sqlite.
    – Lekensteyn
    Apr 16, 2011 at 13:36
  • I was hoping adding cookies.sqlite to roaming.default.files would force Firefox to keep it updated, but no go. I'm not good w/ JS, but if it has a get_cookies() function, and can write to HTML5 storage, that might just work.
    – user11553
    Apr 16, 2011 at 15:11
  • @barrycarter: added Greasemonkey script. Please report back if it works.
    – Lekensteyn
    Apr 16, 2011 at 16:05
0

you can find your session id in the sessionstore.js in your profile. grep for:

{"host":"<your site>","value":"(.+)","path":"/","name":"JSESSIONID","httponly":true}

with the appropriate value for as shown in the FF cookie management window.

It could well be that this only works if you have activated the session restore mechanism in the properties.

You must log in to answer this question.