1
votes
  • Browser: IE 9
  • Framework: Symfony 1.2
  • plugin: sfguard

Examples:

  • mainDomain: domain.com
  • subdomain: subdomain.domain.com

When you open ie, go to mainDomain, log in, then go to subdomain, you are already logged in, I don't want that and I already fixed it saving the session in different places(session_save_path). So here is my main problem:

1st Scenario: open ie, go to mainDomain(User is not logged in), then open a new tab, go to subdomain.

2nd Scenario: open ie, go to subdoamin, then open a new tab, go to mainDomain.

When user try to log in using the subdomain: 1st Scenario: User can not log in, the application make a redirect to the login page. 2nd Scenario: User can log in.

What I've seen using Fiddler is: 1st Scenario: domain:

**Response** sent xxx bytes of Cookie data:
    Set-Cookie: symfony=drub66g3jlv16ukp1vf00hei42; path=/

subdomain:

**Request** sent xxx bytes of Cookie data:
symfony=drub66g3jlv16ukp1vf00hei42;

When try to login:

Response sent xxx bytes of Cookie data:
    Set-Cookie: symfony=9r0bqkmb29gqbe8pnhmae1rsj6; path=/

redirect to home page:

Request sent xxx bytes of Cookie data:

symfony=drub66g3jlv16ukp1vf00hei42;
symfony=9r0bqkmb29gqbe8pnhmae1rsj6;

Note that the last request is sending the same cookie twice! and one of them correspond to the main domain!!! Seem like the mainDomain cookie is overwriting the subdomain cookie!!!

but in second scenario the cookies are sent in this order: Request sent xxx bytes of Cookie data:

symfony=9r0bqkmb29gqbe8pnhmae1rsj6;
symfony=drub66g3jlv16ukp1vf00hei42;

Looks like this works because the subdomain cookie is being sent first!

I have seen that ie has issues with underscores in the subdomain but that is not my case, I've also set ie to accept all cookies and for every test I've done, first I clear all cookies and cache.

I know that symfony 1.2 is old but right now I can not migrate to symfony 2 and I think this is not a problem about symfony but ie.

1

1 Answers

0
votes

I had an issue similar to this, in Silex (which uses the symfony sessions component) and the quick fix was just to name the two session cookies differently. It seems that IE treats cookies at different levels of the domain differently from other clients.