Monday, 19 August 2013

Having bugs/anomalies switching to subdomain friendly cookie

Having bugs/anomalies switching to subdomain friendly cookie

So I have 2 asp.net web form apps with my own custom authentication.I have
been using webapp1 for years and never had any problems with my custom
forms authentication on webapp1.
I have recently launched webapp2 and some users from webapp1 need to
access webapp2. So I switched my cookie domain from www.webapp1.com to
.webapp1.com. Then I point a subdomain neo.webapp1.com to webapp2. This
allows webapp2 to see the already created cookie from webapp1.com and then
I can "refresh" the users active session, so to speak, for a seamless user
experience. This is a necessary setup that I must have, please don't
suggest that I make users relogin into webapp2. Users can't know that they
are on webapp2 they must feel that they are still on webapp1.
The problem is that I am starting to receive reports of existing users
having trouble logging into webapp1.com. I have had them delete existing
cookies. I even successfully solved a user's issue logging in with IE10 by
changing my code from .webapp1.com back to www.webapp1.com cookie domain.
I also have a user that can login with Firefox but not Chrome or IE.
Chrome works for me but not another user. IE 10 works fine for me but not
another user.
Are sub domain friendly cookies reliable? I know there are inherent
security vulnerabilities but security is not a big concern for my web
applications.

No comments:

Post a Comment