Thursday, 15 November 2012

ASP.NET 4 fails to set cookies for IE10… because it thinks it’s IE-1 ! (But there’s a hotfix)

We were seeing something odd when testers would browse to certain test servers using IE10.  The user would log in, but then a redirect would fail to happen, and the user would get kicked back to the login screen.
I tested it using IE10 on a Windows 8 virtual machine, and also tried it on my Win 7 dev machine with the IE10 preview.  Both failed in the same way.
I looked at the web traffic on the client side using Fiddler.  (What a great program!  But I just noticed, via a message that appears in the upgraded Fiddler, that they have “joined the Telerik family”.  Interesting.  They say they’re going to keep it free… fingers crossed that remains true!)
Anyway I tried hitting the test site with IE10, and then I tried it with Chrome on Windows 8; then I also tried IE 8, running on my Win 7 dev machine.  Here’s what I saw when I looked at the “Raw” view for the 302 redirect event.  The problematic string is shown in red.  It seemed to be stuffing some long encrypted string in front of the redirect URL.
IE10:
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: /(F(kxQ3Uf_87HS8e2KvJfipg5YpF8JFVG_vsAxGsIUUfvbIUfO2RkMTP7CmV_trwq5MY82TAW0sAcH5QsrNQJq7p_jpw-6_hGf1O99FzJlleWc1))/PassiveTokenServiceHandler.ashx?wtrealm=http://ourclientweb.ourclientst1.local:8882/default.aspx&realmkey=OurClientRealm
Server: Microsoft-IIS/7.0
X-AspNetMvc-Version: 2.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 14 Nov 2012 09:42:10 GMT
Content-Length: 356

IE8 on Windows 7:
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: /PassiveTokenServiceHandler.ashx?wtrealm=http://ourclientweb.ourclientst1.local:8882/default.aspx&realmkey=OurClientRealm
Server: Microsoft-IIS/7.0
X-AspNetMvc-Version: 2.0
X-AspNet-Version: 4.0.30319
Set-Cookie: Form_Login=145038F0A77F3C43361B30B984054913A627A7EA3AB8AA24D54F091AB7FC71ECD069AE685B32A0E1A8943F518B97974EE1D4FE2BAEBD8071A6564B6E34B179EEEE29A85F954CA3A47586782FE4A79A4D; path=/; HttpOnly
X-Powered-By: ASP.NET
Date: Wed, 14 Nov 2012 10:46:00 GMT
Content-Length: 240

Chrome on Windows 8 (desktop):



HTTP/1.1 302 Found
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: -1
Location: /PassiveTokenServiceHandler.ashx?wtrealm=http://ourclientweb.ourclientst1.local:8882/default.aspx&realmkey=OurClientRealm
Server: Microsoft-IIS/7.0
X-AspNetMvc-Version: 2.0
X-AspNet-Version: 4.0.30319
Set-Cookie: Form_Login=CE02CF980D5FBE5601C57C420BE71FD03205758EE5FF2736D1DAE201A736C18B02AE52AA6EE02AB5F28670406DF981AEA230A5AABE5BA9B7006F211F5FF43B4B412EF69100F0ECE1FD9AFF05A6A6837A; path=/; HttpOnly
X-Powered-By: ASP.NET
Date: Wed, 14 Nov 2012 09:55:10 GMT
Content-Length: 240


Notice any difference, besides the fact that the Location value has the garbage string stuffed into it?  Turns out the “Set-Cookie” isn’t there.  We found this post on Stack Overflow, which looked a lot like our problem; also this post on Stack Overflow and ultimately this MS blog post.

The bottom line is, if your site is using user agent sniffing, then it will think that your IE10 client is IE1!  Notice from this Wikipedia history of Internet Explorer that cookie support didn’t come in until IE2.  That explains why in the Fiddler data above, there’s no “Set-Cookie”.

We installed the hotfix on our test servers, re-booted, and the problem went away.  You can find the hotfix here.

Reminds me somehow of the Y2K bugOpen-mouthed smile

No comments:

Post a Comment