Member Avatar for dips255

I am facing a problem on setting up some cookies with asp on IE6 and IE7

I need to set following cookies when user logs in to his account.

Response.Cookies("crmadmin_login_id") = session("login_id")
Response.Cookies("crmadmin_cuser_id") = rsbrokercrm("cuser_id")
crmuserlevel = cint(rsbrokercrm("cuser_level"))
Response.Cookies("crmadmin_level") = crmuserlevel

Response.Cookies("cid") = rsbrokercrm("c_id")
Response.Cookies("company_name") = rsbrokercrm("Company_Name")

When I comment above lines the session("login_id") works properly however when i run the above code in IE6/7 (on the page where I am authenticating our user's credentials) it kills session("login_id") which is required for accessing the account. This happens when the page is redirected from authentication page to the account page. I tried another option i.e. removed above code block from authentication page and put it on account page. then the account page worked, but again when I click any other page which requires session("login_id"), it again kills the session.

Please help

  • 2 Contributors
  • 3 Replies
  • 131 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by ArtistScope

Dani AI

Generated

Brief recap and what likely happened: classic ASP session state depends on a session cookie. If the browser drops that cookie the server-side Session looks “killed” even though the server didn’t explicitly end it. As discovered, removing/reducing the cookies fixed the problem; that behavior matches old IE limits and how browsers handle cookie counts and sizes.

Practical debugging steps

  • Capture the authentication response and the subsequent request headers (Fiddler, Wireshark, or IE dev tools) and inspect all Set-Cookie/Cookie headers. Look for whether the ASP session cookie is present on the redirect request.
  • Check how many cookies the site (and other subdomains) already store and the size of each value; IE6/7 are sensitive to cookie count and per-cookie size.
  • Test with a clean browser profile (no preexisting cookies) and then with progressively more cookies to reproduce the failure.

Immediate fixes and safer approaches

  • Keep only essential data in client cookies. Move nonessential or large data into server-side storage and keep a single short cookie (a random token or ID) to rehydrate state.
  • Consolidate small items into one compact cookie value instead of many separate cookies; shorten keys/values and URL-encode them so the total stays small.
  • Use a server-side lookup token (generate a random token, store it with the user id + expiry in a DB, set only that token as the cookie). This avoids exposing user ids and avoids blowing client-side limits.

Security and server-side notes

  • Do not store sensitive data (passwords, raw user privileges) in plain cookies. Mark cookies as HttpOnly and Secure when appropriate, and consider signing or hashing cookie contents.
  • Also rule out server-side causes: app-pool recycles or in-process session loss will also drop sessions independently of the client. If sessions drop only in IE on the client machine, it’s almost certainly a cookie limit issue.

This complements ’s consolidation idea and explains why ’s reduction of cookie count resolved the problem.

Member Avatar for ArtistScope

They are separate cookies so an additional cookie shouldn't break anything, or affect a cookie that has just been written.

Member Avatar for dips255

I have got the solution through this post . I have reduced the number of cookies and its working fine now

Member Avatar for ArtistScope

To reduce the number of cookies you can store all information in the one cookie. For example:

strCookieKey = 'MyCookieName"
response.cookies (strCookieKey)("UI") = strUsername
response.cookies (strCookieKey)("UC") = strUserCountry
response.cookies (strCookieKey)("UL") = strUserLanguage
response.cookies (strCookieKey).expires = DATE + 365 'Cookie expires in 365 days

Also, I find it best to declare and assign all variables from a database before referencing them at intervals.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.