• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Simple .NET 2.0 app. Cookies working in dev, not in prod.

StageLeft

StageLeft

No Lifer
Well, this is just very strange.

I have a .NET 2.0 web app that uses the standard request and response.cookies classes in the framework. These work perfectly in Firefox and in IE.

The application resides on Server A. On Server B I have an asp application with some pages and on one of these pages is an iframe that simply points to the app on Server A, similar to if you made a web page and a window of it pointed to CNN or ford.com or something. Server C is the prod version of B. Same code base, different machine, it also points to Server A's web app (only one version of the Server A web app).

This works perfectly, including the cookies on Server B. However, when we move from the dev to production environment for the other asp web pages, so we're going from Server B with an iframe of the A web app to server C with an iframe of the A web app, cookies only work in Firefox! In IE they absolutely, 100% do not work at all! They don't display, don't save or anything. When I go back to Server B to look at A in its iframe or navigate directly to A, the cookies are perfect.

I thought maybe IIS on Server C had its settings weird, but they do work with firefox. And in any case, Server A, with the actual web app NEVER changes!
 
Originally posted by: MrChad
What are the domain names of servers A, B and C?
Click to expand...
Well, in a generic sense (I'd rather not put it out here!) they are like:

ServerA = something.hosting.hostcomp.com
ServerB = something.applications.hostcomp.com
ServerC = awesomesite.com

Not sure how much that helps 😉

 
If you want to learn why this is happening go install LiveHTTPHeaders for Firefox and compare the outputs of browsing to all 3 servers.

If you just want to fix it, your ServerC is specifying an invalid domain for the cookie so the browsers are not setting them because it can't verify that the cookie is actually coming from the domain. It's to prevent your site from setting a cookie for someone else' site.

In .NET the Cookie objects have a Domain property that you can change, so make sure that's getting set properly.

edit: btw, you would probably get more/better responses over in the Programming forum.
 
Originally posted by: Skoorb
Thanks, that may give me something to go on...
Click to expand...

I'd help more, but I've only worked with consuming web services in .NET instead of writing them 😛, but the issue is the same across all languages as it's a security flaw.

Imagine typing in google.com only to have google set cookies for analpron.com, that's definitely an undesirable result 🙂
 
Originally posted by: Crusty
Originally posted by: Skoorb
Thanks, that may give me something to go on...
Click to expand...

I'd help more, but I've only worked with consuming web services in .NET instead of writing them 😛, but the issue is the same across all languages as it's a security flaw.

Imagine typing in google.com only to have google set cookies for analpron.com, that's definitely an undesirable result 🙂
Click to expand...
Says who? 🙂

EDIT: I put in livehttpheaders for firefox 3, but nothing seems to happen. I can go to tools > Add ons, but the "Add live httpheaders to sidebar" does nothing, and more importantly I cannot see any content in the two big panes. Also when I check extra boxes and then close, and reload it, nothing seems to take place? Is it not fully installed or something...?

EDIT 2: crap, it doesn't work with FF 3.0.3. I may see about an older FF version to get this going...
 
Originally posted by: Skoorb
Originally posted by: MrChad
What are the domain names of servers A, B and C?
Click to expand...
Well, in a generic sense (I'd rather not put it out here!) they are like:

ServerA = something.hosting.hostcomp.com
ServerB = something.applications.hostcomp.com
ServerC = awesomesite.com

Not sure how much that helps 😉
Click to expand...

My guess is that this is a domain issue. Server C won't be able to read the cookies from Server A or B because it doesn't reside in the same domain.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top