13

Session cookies are working fine in Chrome and Firefox, but with IE9 and AJAX requests, I lose all session cookies.

Direct request to view

  public class AddressController : Controller
  {
    [MvcSiteMapNode(Title = "Addresses", ParentKey = "MyAccount", Key = "Addresses")]
     public ActionResult Index()
     {
        ....
         var memberId = GetKeyValues.GetMemberId(); // This works perfect.
        ...
      }

Ajax call

   $.ajax({
        url: "/Address/CheckPrimaryAddressGood?t="+ Math.random(),
        type: "Get",
        success: function(data) {
         ...

public class AddressController : Controller
{
    public ActionResult CheckPrimaryAddressGood()
        {
           ...
           var memberId = GetKeyValues.GetMemberId();
           ...
       }
 }
 public static class GetKeyValues
 {
    public static string GetMemberId()
    {
         if (HttpContext.Current.Session[keyCookie] != null)
            {
                memberId = GetMemberIdFromSession();
            }
            else if (HttpContext.Current.Request.Cookies["token"] != null)
            {
                memberId = GetMemberIdFromCookie();
            }
    }
}

From AJAX call I lost cookies values only IE9. I tried P3P override still did not work from this post P3P link

Has anyone had a similar issue? Please let me know how to resolve this. I spent already a day on this.

Edit

I just traced in Fiddler IE is not sending Header data it is just sending "Connection=Keep-Alive&Pragma=no-cache&Accept=*%2f*&Accept-Encoding=gzip%2c+deflate&Accept-Language=en-US&Host=ebiz.company.com%3a28712&User-Agent=Mozilla%2f5.0+(compatible%3b+MSIE+9.0%3b+Windows+NT+6.1%3b+WOW64%3b+Trident%2f5.0)&Origin=http%3a%2f%2febiz.spe.org%3a28712}

but Chrome: {Connection=keep-alive&Accept=*%2f*&Accept-Encoding=gzip%2c+deflate%2c+sdch&Accept-Language=en-US%2cen%3bq%3d0.8&Cookie=ASP.NET_SessionId%3d2a4tr1ymierclqsfxyfahqbc%3b+__session%3a0.5654769616667181%3ashowwarning%3dtrue%3b+__session%3a0.5654769616667181%3aBadAddressWarning%3dfalse%3b+ ....

Why?

Community
  • 1
  • 1
James123
  • 11,184
  • 66
  • 189
  • 343
  • It might be an issue with Security-Zones in IE. So if your Connection was http and the request ist https it'll use another set of Cookies (more or less another user-context). – TGlatzer Jun 23 '15 at 15:35
  • There is already a similar question here on SO, have a look here: http://stackoverflow.com/questions/389456/cookie-blocked-not-saved-in-iframe-in-internet-explorer/389458#389458 – David Votrubec Jun 25 '15 at 11:38

2 Answers2

5

These are just some ideas, which may help (and you've probably read or tried these by now). There doesn't seem to be a silver bullet.

Some other questions had similar problems, that don't seem to be exactly yours (especially since you tried P3P). Also lots of posts in general on the internet, all around the same few issues.

No Session Cookies on Internet Explorer 9 AJAX requests

Cookie blocked/not saved in IFRAME in Internet Explorer

Some ideas:

  • One answer had problems with underscore in the url. You don't have that, but can you try a clean one without the random parameter? Just in case it doesn't like that.
  • Lots of posts about trouble doing this from within an iframe. If you don't have an iframe, this isn't the problem.
  • P3P, you said you tried; I saw one comment that the header has to be set on every request, not just the ones looking for session/cookies.
  • Cross-domain / CORS problem? Doesn't look like it with your root-relative url.
  • Try an IE9 on another computer? Silly, but maybe it's some obscure setting on your browser; zones, etc.

  • Does fiddler show a session id on a regular page browsed on your site? (just to make sure it's not site-wide vs. just this ajax call).

  • I usually Post ajax instead of Get (just had a lot of data), and do have session working. This also avoided needing the cache-busting random parameter.

  • I'm using good old web forms instead of mvc, and posting to asmx. On the asmx method, I need to decorate the server-side method.

    // ScriptService and ScriptMethod are required for the jquery.ajax() call. They weren't required for jquery.post(). WebMethod needed for session.
[WebMethod(EnableSession = true)]
[ScriptMethod]
public string DoSomething() ...
Community
  • 1
  • 1
goodeye
  • 2,389
  • 6
  • 35
  • 68
  • 1
    Perfect summary, thank you. I got Iframe in my page and a have been trying to set correct P3P headers for days until i discovered that i have underscores in my test domain =-O Long live IE... elsewhere. – Aiphee May 05 '16 at 08:16
2

Have you thought of using sessionStorage? check it out for firefox

https://developer.mozilla.org/en-US/docs/Web/API/Window/sessionStorage

for all other browsers:

https://code.google.com/p/sessionstorage/

The Bumpaster
  • 944
  • 7
  • 20