1

We have a very strange issue that only occurs in IE (we're using 11, haven't tested with other versions). The issue doesn't appear with either Firefox or Chrome. Cookies persist correctly after a redirect on pages within one subdomain, but not on pages within a different subdomain.

To reproduce the error, I created two .asp pages.
Cookie_Test.asp

<% 
Response.Cookies("DebugCount") = 20
Response.Cookies("IRCookie")("Enabled") = True
Response.Redirect("Cookie_Test_2.asp")
%>

Cookie_Test_2.asp

<% 
Response.Write "DebugCount " & Request.Cookies("DebugCount") & "<br/>"
Response.Write "Enabled " & Request.Cookies("IRCookie")("Enabled") & "<br/>"
%>

On one domain within our network (dev.localserver), the output is correct, as we'd expect:

DebugCount 20
Enabled True

But, on a different subdomain (dev_v5.localserver), the output is empty:

DebugCount 
Enabled

This is for exactly the same IE 11 browser, proven on multiple different workstations. The subdomains are either in the browser's Trusted Sites listing (Internet Options, Security, Trusted Sites) or not for all machines tested -- The Trusted site status doesn't seem to affect the issue.

I checked to see if this has something to do with the Redirect, and it does. If I put the set and get in the same file, it works fine under both subdomains.

Could there be a setting in IIS that affects how a domain handles cookies? Is it possible that under one of the subdomains, the cookies are being consider "third-party" (although Third-party Cookies are being Accepted in the Privacy tab, as well as Session Cookies?)

Daniel Bragg
  • 1,773
  • 1
  • 12
  • 25

1 Answers1

0

According to the very helpful post here, we had a look at the subdomains themselves. Since none of our clients have encountered the error, but we only found it internally, we have complete control over the subdomains, so instead of calling them "dev" and "dev_v5", we renamed them to "dev4" and "dev5" and found that now the redirects passed the Set-Cookie response header correctly in both cases.

I know this may not help anyone, but in our case, something that seemed to have no direct bearing on how cookies should be handled did indeed have an effect that needed to be mitigated.

Daniel Bragg
  • 1,773
  • 1
  • 12
  • 25