Microsoft Windows Vista Community Forums - Vistaheads
Recommended Download



Welcome to the Microsoft Windows Vista Community Forums - Vistaheads, YOUR Largest Resource for Windows Vista related information.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so , join our community today!

If you have any problems with the registration process or your account login, please contact us.

Driver Scanner

IE8 BUG - Cookie Expiration

microsoft.public.internetexplorer.general






Speedup My PC
Reply
  #1 (permalink)  
Old 05-03-2009
Steve Commisso
 

Posts: n/a
IE8 BUG - Cookie Expiration
I found a bug in IE8 in the way it handles the expiration dates. I'm
developing an ASP.NET MVC website and was implementing login/logout. It all
worked great on IE7, FireFox, and Chrome. However, in IE8, I couldn't log out.

I had been using the "DIEYOUGRAVYSUCKINGPIGDOG" approach when expiring my
cookies. Instead of setting the expiration date to DateTime.Now.AddDays(-1),
I was going overboard with DateTime.Now.AddYears(-50). However, it appears
that IE8 did not like the 1959 date. It wouldn't just ignore the expiration
date, it didn't seem to process the cookie at all, as I was also changing the
cookie value, but subsequent requests were not showing that the value changed.

After playing with Fiddler for a few hours, I decided to try changing that
to the more conventional .AddDays(-1), and wouldn't you know, that worked.
The authentication cookie was being expired, and all was good.

I don't really feel like figuring out how far back the expiration date is
processed correctly, but this should help repro the issue.
Reply With Quote
Sponsored Links
  #2 (permalink)  
Old 05-03-2009
Steve Commisso
 

Posts: n/a
RE: IE8 BUG - Cookie Expiration
Ugh... nevermind, I thought it was working, but it's still not. I'm not sure
what the bug is. Anyway, here is the raw data from fiddler:

From the request to the logout page (note: it's executing a GET, maybe
that's the issue? Does it only process cookies on POST responses?):
Cookie:
ZLEEK.ASPXAUTH=auth=1G3FkUIsm86pSTK1bXbN42zX3iFD3L 2ZJptWtomzV5r2bf6a0iPQssAIVAjl9G-hxb0uqUSxeaiAsMshKt4Yt22vCLLAFirp&rem=true;
ASP.NET_SessionId=1xxrkwivpl5nd545ydqabxmm

Response from the server:
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Expires: Sun, 03 May 2009 06:24:42 GMT
Server: Microsoft-IIS/7.0
X-AspNetMvc-Version: 1.0
X-AspNet-Version: 2.0.50727
Set-Cookie: ZLEEK.ASPXAUTH=; expires=Sat, 02-May-2009 00:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Sun, 03 May 2009 06:24:42 GMT
Connection: close
Content-Length: 2963

Next request from client:
Cookie:
ZLEEK.ASPXAUTH=auth=1G3FkUIsm86pSTK1bXbN42zX3iFD3L 2ZJptWtomzV5r2bf6a0iPQssAIVAjl9G-hxb0uqUSxeaiAsMshKt4Yt22vCLLAFirp&rem=true;
ASP.NET_SessionId=1xxrkwivpl5nd545ydqabxmm

I'm going to try executing logout on a POST... that's what it should be
doing anyway...
Reply With Quote
  #3 (permalink)  
Old 05-03-2009
Steve Commisso
 

Posts: n/a
RE: IE8 BUG - Cookie Expiration
Wish you could delete a post. Apparently it was a weird caching problem.
Cleared cache and it worked. Problem came up again, hit F5 to refresh the
page and it showed logged out...

Do not code when tired.

"Steve Commisso" wrote:

> Ugh... nevermind, I thought it was working, but it's still not. I'm not sure
> what the bug is. Anyway, here is the raw data from fiddler:
>
> From the request to the logout page (note: it's executing a GET, maybe
> that's the issue? Does it only process cookies on POST responses?):
> Cookie:
> ZLEEK.ASPXAUTH=auth=1G3FkUIsm86pSTK1bXbN42zX3iFD3L 2ZJptWtomzV5r2bf6a0iPQssAIVAjl9G-hxb0uqUSxeaiAsMshKt4Yt22vCLLAFirp&rem=true;
> ASP.NET_SessionId=1xxrkwivpl5nd545ydqabxmm
>
> Response from the server:
> HTTP/1.1 200 OK
> Cache-Control: private
> Content-Type: text/html; charset=utf-8
> Expires: Sun, 03 May 2009 06:24:42 GMT
> Server: Microsoft-IIS/7.0
> X-AspNetMvc-Version: 1.0
> X-AspNet-Version: 2.0.50727
> Set-Cookie: ZLEEK.ASPXAUTH=; expires=Sat, 02-May-2009 00:00:00 GMT; path=/
> X-Powered-By: ASP.NET
> Date: Sun, 03 May 2009 06:24:42 GMT
> Connection: close
> Content-Length: 2963
>
> Next request from client:
> Cookie:
> ZLEEK.ASPXAUTH=auth=1G3FkUIsm86pSTK1bXbN42zX3iFD3L 2ZJptWtomzV5r2bf6a0iPQssAIVAjl9G-hxb0uqUSxeaiAsMshKt4Yt22vCLLAFirp&rem=true;
> ASP.NET_SessionId=1xxrkwivpl5nd545ydqabxmm
>
> I'm going to try executing logout on a POST... that's what it should be
> doing anyway...

Reply With Quote
  #4 (permalink)  
Old 05-03-2009
Kai Schaetzl
 

Posts: n/a
Re: IE8 BUG - Cookie Expiration
Steve Commisso schrieb am Sat, 2 May 2009 23:25:01 -0700:

> I don't really feel like figuring out how far back the expiration date is
> processed correctly, but this should help repro the issue.


But what for? There is no need to have such old cookie dates. In fact, I use
-3600 seconds for expiration.

Kai
--
Helpsites about Windows: http://www.mvps.org
IE repair script: http://iefaq.info

Reply With Quote
  #5 (permalink)  
Old 05-03-2009
Kai Schaetzl
 

Posts: n/a
Re: IE8 BUG - Cookie Expiration
Steve Commisso schrieb am Sat, 2 May 2009 23:52:11 -0700:

> Wish you could delete a post. Apparently it was a weird caching problem.
> Cleared cache and it worked. Problem came up again, hit F5 to refresh the
> page and it showed logged out...


The second problem or your 50 year approach?

Kai
--
Helpsites about Windows: http://www.mvps.org
IE repair script: http://iefaq.info

Reply With Quote
  #6 (permalink)  
Old 05-03-2009
Steve Commisso
 

Posts: n/a
Re: IE8 BUG - Cookie Expiration
OK, found the problem. When I was removing the auth cookie, I wasn't setting
the domain again. I was pulling the cookie from the request, modifying some
values, and adding to the response. Odd thing is that this very same code
worked fine on another website. Maybe it has to do with IIS?

The working server is a Win2K3 box with IIS6. The one which had the problem
is a Win2K8 box with IIS7.

Also, this wasn't working in IE7,Firefox,Chrome... was a caching issue there
as well.

"Kai Schaetzl" wrote:

> Steve Commisso schrieb am Sat, 2 May 2009 23:52:11 -0700:
>
> > Wish you could delete a post. Apparently it was a weird caching problem.
> > Cleared cache and it worked. Problem came up again, hit F5 to refresh the
> > page and it showed logged out...

>
> The second problem or your 50 year approach?
>
> Kai
> --
> Helpsites about Windows: http://www.mvps.org
> IE repair script: http://iefaq.info
>
>

Reply With Quote
  #7 (permalink)  
Old 05-03-2009
Steve Commisso
 

Posts: n/a
Re: IE8 BUG - Cookie Expiration
Yeah, like I said, it was pointless but I just set it like that for fun --
but that wasn't the issue anyway, thanks.

"Kai Schaetzl" wrote:

> Steve Commisso schrieb am Sat, 2 May 2009 23:25:01 -0700:
>
> > I don't really feel like figuring out how far back the expiration date is
> > processed correctly, but this should help repro the issue.

>
> But what for? There is no need to have such old cookie dates. In fact, I use
> -3600 seconds for expiration.
>
> Kai
> --
> Helpsites about Windows: http://www.mvps.org
> IE repair script: http://iefaq.info
>
>

Reply With Quote
  #8 (permalink)  
Old 08-16-2009
 

Join Date: Aug 2009
Posts: 2
MikeOtown is on a distinguished road
Thanks: 0
Thanked 0 Times in 0 Posts
Re: IE8 BUG - Cookie Expiration
Are you able to see the "ASP.NET_SessionId" cookie in IE8's Developer Tools -> Cache menu -> Cookie Information page?
Reply With Quote
  #9 (permalink)  
Old 08-16-2009
rob^_^
 

Posts: n/a
Re: IE8 BUG - Cookie Expiration
Yes?

"MikeOtown" <MikeOtown.3x0z4e@no-mx.forums.vistaheads.com> wrote in message
news:MikeOtown.3x0z4e@no-mx.forums.vistaheads.com...
>
> Are you able to see the "ASP.NET_SessionId" cookie in IE8's Developer
> Tools -> Cache menu -> Cookie Information page?
>
>
> --
> MikeOtown
> Posted via http://www.vistaheads.com
>
>

Reply With Quote
  #10 (permalink)  
Old 08-17-2009
 

Join Date: Aug 2009
Posts: 2
MikeOtown is on a distinguished road
Thanks: 0
Thanked 0 Times in 0 Posts
Re: IE8 BUG - Cookie Expiration
Quote:
Originally Posted by rob^_^ View Post
Yes?
You sound like you're not sure. Can you post a screen shot?
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
WHS Expiration Bill microsoft.public.de.windows.homeserver 0 03-09-2008 14:48
Google cookie expiration plans called 'worthless' Steve Security News 0 07-22-2007 09:51
Google cookie expiration plans called 'worthless' Steve Security News 0 07-21-2007 09:52
Google cookie expiration plans called 'worthless' Steve Security News 0 07-19-2007 21:53
Expiration =?Utf-8?B?ZGVicm9zZXk=?= microsoft.public.windows.vista.general 7 02-28-2007 19:42




All times are GMT +1. The time now is 16:41.




Driver Scanner - Free Scan Now

Vistaheads.com is part of the Heads Network. See also XPHeads.com , Win7Heads.com and Win8Heads.com.


Design by Vjacheslav Trushkin for phpBBStyles.com.
Powered by vBulletin® Version 3.6.7
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.6.0 RC 2

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120