Timon Christl

I'm currently trying to figure out why IE7 won't accept my cookie (used to persist a session ID). The cookie is correctly sent with subsequent requests by Firefox and Opera, but not by IE7.

This is what fiddler shows as the headers of a first request:

GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, application/msword, application/ag-plugin, */*
Accept-Language: de
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.5.20404)
Host: www_christltimon_de.nexus.home
Proxy-Connection: Keep-Alive

The server answers with

HTTP/1.1 302 Found
Date: Sat, 19 May 2007 19:18:37 GMT
Server: Apache/2.2.4 (Win32) PHP/5.2.2
X-Powered-By: PHP/5.2.2
Set-Cookie: www_christltimon_de-SID=m1q3sprh1th43o9vs3eoaor095; expires=Mon, 18 Jan 2038 15:34:07 GMT; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: permalink.php p=start
Content-Length: 0
Content-Type: text/html

As you can see there is a Location: header, this is because a request for / is answered by a redirection to my permalink helper script, which then chooses an appropriate start page to display at that time. You can also see the Set-Cookie: header. The headers of the next request are:

GET /permalink.php p=start HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, application/msword, application/ag-plugin, */*
Accept-Language: de
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.5.20404)
Host: www_christltimon_de.nexus.home
Proxy-Connection: Keep-Alive

No signs of any Cookie: header here. The temporary internet files folder also shows no stored cookie. IE7 is set to accept each and every cookie, yet it doesn't.

For comparison, this is what Opera sends as first request:

GET / HTTP/1.0
User-Agent: Opera/9.20 (Windows NT 5.1; U; en)
Host: www_christltimon_de.nexus.home
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: de-DE,de;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Pragma: no-cache
Cache-Control: no-cache
Proxy-Connection: close

Again the server answers with:

HTTP/1.1 302 Found
Date: Sat, 19 May 2007 19:35:25 GMT
Server: Apache/2.2.4 (Win32) PHP/5.2.2
X-Powered-By: PHP/5.2.2
Set-Cookie: www_christltimon_de-SID=808535hm6rminftfrqc3k8ff44; expires=Mon, 18 Jan 2038 15:34:07 GMT; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: permalink.php p=start
Content-Length: 0
Connection: close
Content-Type: text/html

and Opera proceeds with:

GET /permalink.php p=start HTTP/1.0
User-Agent: Opera/9.20 (Windows NT 5.1; U; en)
Host: www_christltimon_de.nexus.home
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: de-DE,de;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Cookie: www_christltimon_de-SID=808535hm6rminftfrqc3k8ff44
Cookie2: $Version=1
Pragma: no-cache
Cache-Control: no-cache
Proxy-Connection: close

Here a Cookie: header is sent, as I would expect. The same applies to Firefox. I really don't understand why this doesn't work in IE7. It used to work in IE6, since the session-related functions in my code are pretty much unchanged since 2004 or so.

I hope someone can help me out on this one.



Re: Internet Explorer Web Development IE7 won't accept my cookie

Marc Lester

I've actually come accross the same problem with a website. We use the same login system for all our sites, just simple cookie / db stuff and some users with IE7 report that they cant log in, and doing a javascript:alert(document.cookie) in the address bar brings up no cookies, though this only happens with "some" IE7 users, my test box with IE7 works fine. All other browsers save the cookie fine (even IE6)

I know one person who contacted me with this problem could log in fine with IE6, but after they upgraded to IE7 they couldn't log in again. And one thing i know this person did on IE6 was set the cookie settings to accecpt cookies from that website. Could it be something to do with the settings from IE6 before the upgrade to IE7





Re: Internet Explorer Web Development IE7 won't accept my cookie

Nikola123

I have the same problem with IE 7, while in IE 6 an Firefox works great.

Has anyone come with some kind of solution yet





Re: Internet Explorer Web Development IE7 won't accept my cookie

NowOnline

ie7 not accepting specific cookiies, namely my website hahaSmile joy! NOT

works in firefox and version 7 of ie on my other computers,

microsoft needs to adress the issue specifically






Re: Internet Explorer Web Development IE7 won't accept my cookie

Phil Martin

Hello Timon,

A very late reply I know, but I stumbled across this very same problem, and after a great deal of hitting brick walls, I found it:

The host name contains underscores (_), and IE7 won't accept cookies from those hosts.

It sounds strange, and I couldn't beleive it, but that was it.

I hope it helps! (even though it is 4 months late)

- Phil




Re: Internet Explorer Web Development IE7 won't accept my cookie

Timon Christl

Thanks Phil Martin,

better late than never. I never thought of this. I looked it up in the DNS RFCs and underscores are indeed not allowed in domain name labels. It's a bit strange then that my local DNS server accepted that name in the first place.

Again, thanks for this answer.