cookie problem

[silverspecv]

Some users lose their cookie!

http://www.specializedsolutions.com/resellers

username: tek
password: tek

If the login is successful, it sets a cookie then forwards (not cflocation) to a page with some downloads. If the login failes or the cookie does not exist (such as if they bookmark the download page), the user will be forwarded back (cflocation) to the login page above. Very standard.

The problem is that on some users' machine, the login is successful, the cookie is set, they get forwarded to the download page. Since they are looking at the download page, I can deduce that the cookie has to exist at least briefly now, or else they would have been sent back to login. So it LOOKs like they are in, but if they refresh/reload the page, the cookie is gone, and they get forwarded back to logon.

The bug is on a per machine basis. Firefox seems to work fine on 100% of machines (surprise!), but IE fails on about 50% of machines (surprise!). And for the life of me, I cannot figure out what the difference is. I opened the internet options screen on 2 machines and compared them side by side. 2000 pro and 2000 server, and they are freaking identical down to every last checkbox, radio button, and IE version. The only difference is one works and one doesn't. I also tried it on xp pro, and it worked, but 98 se does not (or at least did not, I only tried one of each machine).

I have a cfheader-p3p statement in the application.cfm, and I'm simply using <cfcookie name="member" value="#login.id#"> to set the cookie. I have tried variations on the domain/path attributes, etc, to no avail. You may also notice that the page is actually a frameset which loads the content from another server. This is becomes the host site is static, and obviously coldfusion is not, so I use a different server but make it look seamless. This doesn't seem to make a difference, since I can go directly to

http://www.oncourselearning.com/resellers

and the results are identical.

Anyway, I'm about ready to tear my hair out over this, so any help is greatly appreciated.

 

[webmigit]

In IE: Tools >> Internet Options >> Privacy [tab] >> Advanced [button].

First set it to allow all cookies and session vars, if that works, tweak it til you find the minimum settings that work... then when someone calls you can walk them through this.

Also ZoneAlarm can be a major problem here along with spyware detection programs.

Its almost sick how those programs cause so much fear of cookies.

Cookies and session variables were created for useful purposes. So that you could know who was logged in and keep them logged in. A few sites misuse them and suddenly they're evil.

ALFII.com

http://www.alfii.com

---------------------
If this post answered or helped to answer your question, please reply with such so that forum members with a similar question will know to use this advice.

 

[silverspecv]

No, sorry, that didn't work. I set it to accept all, and it still lost the cookie. Before the changes, the settings were identical to another machine that works fine. Any other ideas?

If everyone out there could test the above link, log in and then refresh the page and see if it throws you back to the login page then tell me what os/browser you're using and whether or not it threw you back to the login, maybe that will help me narrow it down?

 

[webmigit]

No firewalls, no spyware detection programs?

ALFII.com

http://www.alfii.com

---------------------
If this post answered or helped to answer your question, please reply with such so that forum members with a similar question will know to use this advice.

 

[silverspecv]

I figured it out.. I was not specific enough or correct enough with my cookie.. I had to use:

<cfcookie name="member" value="#login.id#" domain=".oncourselearning.com" path="/resellers">

I tried that before, but I used path="resellers" instead of path="/resellers" (oops)

This doesn't mean that there isn't a bug somewhere in internet explorer, since it only happened on IE, not other browsers, and even then only on some computers, but as long as it works now, I'm... er, maybe not happy, but I'm moving on to something else.

 

[webmigit]

Yeah, normally

<cfcookie name="member" value="#login.id#">

should work (even in IE).

But at least you've got something that works.

ALFII.com

http://www.alfii.com

---------------------
If this post answered or helped to answer your question, please reply with such so that forum members with a similar question will know to use this advice.

 

[silverspecv]

That's what I originally had, and it did work on some computers... I dunno.. it doesn't surprise me I guess. You'd think that if a company is going to run a monopoly, they would at least have the common decency to be compatible within themselves.. <shrug>

 

[webmigit]

Microsoft is compatible with Microsoft HTML.. but as we all know, that's the problem. They try to set their own standards regardless of what the rest of the world is trying to do.

Firefox is picking up on MS though, as we all know.. And while Firefox looks mostly like a (don't shoot) IE v3 or v4 clone. It works and it works well and it offers some features that IE v6 doesn't have.

I don't care who wins in the browser war, but as some have said, Firefox may do what NS did years ago.. Ignite initiative at MS.

ALFII.com

http://www.alfii.com

---------------------
If this post answered or helped to answer your question, please reply with such so that forum members with a similar question will know to use this advice.

 

[wantstolearncfm]

Seeing as we are drifting towards a browser war here, my niggles with IE.
The fact that webpages "jump" sometimes i.e you code them all against a template then add another table the ie preview jumps when you change pages, on firefox all the content is ok.
PNG Transparency (Alpha Image Transparency) microsoft totally dont bother with it and fill it in grey!
IE dosnt respect web standards! Table layouts never come out as they should in IE but do in FF.
Anyway shouldnt be ranting....
Whats the easiest way i could use cfcookie to set a username and password when a user logs into a site if they click remember me. Then do the cookie check when they enter the members pages?

http://google.com

http://support.microsoft.com/

CF Reference
The links of my knowledge

 

[silverspecv]

Whats the easiest way i could use cfcookie to set a username and password when a user logs into a site if they click remember me. Then do the cookie check when they enter the members pages?

Yup.. pretty much. Use a cfif to see if they checked the box, and if so, use expires="never" on your cfcookie statement.. just beware that if you set the cookie on

http://www.sitename.com

and then check for it on

http://www.sitename.com/subdir

it might behave differently than you would expect. In some circumstances, you have to use the domain= and path= attributes like I quoted above.