I have a problem with my asp.net web application, its cookies gettting cleared from the browser automatically on some specific systems only. Any help or suggestion will be appreciated.
Related
I'm currently working on an ASP.NET MVC project and I'm using an azure AD to connect to my website.
When I try first on Chrome, for exemple, those are the cookies that are created :
And every thing works fine ! But if I launch the same website on FireFox without stoping IIS express, I got an infinite number of cookies incoming and the server stop and says :
HTTP 400. The size of the request headers is too long.
And got this list of cookies :
If I close IIS Express and retry an other time with FireFox, it created only 3 cookies and works fine...
Can Someone explain me what is going on ?
PS: Please don't give the solution " you need to delete old cookies" it's not the problem here... It doesn't work even if I don't have any cookies... AND nothing matters what browser i'm using, I've tried 6 differents browsers and every time only the first who has been launch is the only one who works.
Thanks in advance for your help !
Reason/Investigations
I think you have some API or AJAX calls which are secure and require authentication. When you change the browser and your requests are no more authenticated and on AJAX or API call it start creating the cookies. I am sure if you will login to the app in FireFox it will stop doing that. I dont think it is a browser specific issue. If you will move the app from Firefox to IE it will do the same.
Solution
Now, you have to either make sure that when you are not logged in or the request is not authenticated you redirect to login page and stop making unauthenticated calls.
Other solution is to delete all nonce cookies as per MikeDotNet solution.
You will find some people suggesting that it is a bug in Microsoft Nuget package Microsoft.Owin.Security.OpenIdConnect and if you use 3.0.0 it will fix the problem. It works in some of the cases but I found that solution good for IIS but not in Cloud.
Here is the problem that I'm having. Often times, I cannot login to my Plone site. Other users have the same issue as well. Basically what happens is that when I click "Log In", the web page just refreshes but it doesn't log me in. In order to correct this problem, I had to clear the browser history and cookies in order to log in successfully. Sometimes I had to do this a few times in order to work. I would like at least 50% of the time I had to clear the history before I can login. Other times, it just works and it logs me in without any issue.
This problem started quite some time ago, perhaps almost a year now. I just never had time to look into it. However it seems like this problem is related to newer version of web browsers because I never had this problem before around one year ago.
I'm running Plone version 4.0.4. Can anyone suggest how I should troubleshoot this problem? Should I upgrade a particular component within my Plone setup?
FYI, I'm using the building authentication component and not anything external like LDAP. I manage my users in Site Setup -> Users and Groups.
Thanks in advance.
Things to look into:
go to /acl_users/session/manage_propertiesForm and check the settings here to make sure they make sense
check cookie settings for if they are valid on non-ssl and that you are logging in via ssl urls.
use a web browser web inspector(like chrome) and inspect that login cookies are set properly after you're logged in(look for the __ac cookie)
Finally, look into your caching. If you're using plone.app.caching, make sure to NOT cache for logged in users. If you're overriding caching at the web server, make sure you're not caching when the __ac cookie is present.
If you're not caching at the web server, make sure cache headers for the browser are also getting set appropriately
inspecting caching will also require using a browser to inspect the headers getting returned
I am facing a problem where ASPXAUTH cookie is not being generated unless the website is hit from the same machine where it is hosted. I have confirmed this by enabling and viewing IIS logs.
From all other machines no matter what, it redirects back to the login page. This is a very strange behaviour as no installation has been made nor any changes to IIS. I would appreciate if anybody could share their experience and suggest a possible solution.
UPDATE : For some unkown reasons it is working with Firefox. Still not able to figure out what is causing this in other browsers !
After 2.5 days of intense searching and hair pulling it turned out that server date/time was not correct !!! I synchronized it with internet clock and cookies worked.
Do you have security settings where you don't allow cookies in the other browsers?
A tester of my new app reported problems with authorization support in ASP.NET MVC app: Whenever he switches to a new tab (different controller), he's prompted for his login again.
After investigation, I found that the server forcibly wants to use cookieless forms authentication using URLs such as in this question.
The problem appears in his Firefox 3.6.15. Not on other browsers on his computer, not on Firefox on other computers. I checked his Firefox options: Cookies are enabled. HTTPfox even says there is an ASPNetSessionId exchanged!
How come? Can anyone shed some light? FWIW, my web.config doesn't say anyhting about cookies or sessions. I didn't even know of these cookieless URLs before seeing them on this computer and doing some research.
Uninstall and reinstall Firefox from his machine. backup his bookmarks first so he doesnt lose anything. It sounds like its an installation issue rather than a coding problem.
My asp.net application works fine when launched from its own browser, but when its launched from another web application (sharepoint webpart) using window.open it works until the user clicks and posts back, then the session is lost.
I think its related to cookies, because when I set the session state to be cookieless everything works fine.
Why does the sesssionid get lost in the NEW application when launching the app using window.open? I would like each application to have its own session cookie, I've tried setting the name of the cookie but the same thing happens, on the first post back the sessionid is lost??
Please help?
Sharepoint manages it's own session. Sessions are tied to applications (URI). You would need to share some sort of login token between applications.
check out:
http://forums.asp.net/t/1335229.aspx
http://forums.asp.net/p/1356006/2781938.aspx
What browser are you using?
IE6 has this exact issue, possibly newer versions as well.
Refer to Microsoft Support
drop window.open(). use links with tarket="blank". if you need to call them from JS just do
link.click() on it.