Unpredictable session fault in IE8

[JonathanMortimer]

Hi,

I will state in advance that I do not have access to the code nor am I the developer, however it has come to me to investigate the problem none the less.

We run an in-house hta / PHP based database application, it is accessed via an internal IP address of the format 192.168.48.250/path_to/hta_script/start.hta. Users log in using their own unique username and password. I am told that it sets a session cookie which is programmed to last 8 hours. I have no experience in programming cookies, but here is what it leaves on a typical problem machine:

PHPSESSID
c6e3a77f4c99aeba477c034a33ad7d65
192.168.48.250/
1536
3045801600
30117900
3103694464
30117816
*


For the most part it works fine, but just a few random people seem to get randomly logged out for no reason, and it will keep on logging them out if they log back in on that session; it looks like it's something perculiar to their Windows user profile as logging in as them on a different machine does not show the problem, likewise if someone else logs into their problem machine using their own Windows profile they do not experience the problem. If a different person logs in to the database application using their own username and password, but does it on the problem-person's window login profile then the problem persists.

Then there is IE8 - after testing it appears to only affect people who have this installed. Roll back IE8 to IE7 or IE6 and the problem goes away immediately (after a reboot), re-install IE8 and the problem is back.

Hopefully this narrows it down to the user's profile and IE8, but beyond that I am clueless as to why it is happening. We have only a handful of people who are affected out of about 80 users, pretty much all of whome should have IE8 installed. It seems to move around though - one week it could be one person affected, next week another. I have tried setting IE8 to run all sites in Compatibility mode but this had no effect. I assume there is something in the IE8 back-end that is causing (or contributing to) the problem, not the IE8 browser front-end.

If anyone can shed any light on this I would be hugely greatful, it's causing such a headache for those who are affected, the only (temporary) fix so far has been to downgrade their browser or delete their Windows profile and create a new one, neither is a proper solution.

I do not know if it is to do with PHP, Windows (it has happened on XP Pro and 7 Ultimate), or IE8, but as I couldn't find an IE forum I have placed it here in case there is a known problem with cookies and IE8.

 

[vacunita]

This sounds more like IE8 is clearing out the cookies, or the cookies are expiring rather than an actual PHP issue. Besides even it was a PHP issue, without any code, there's no way to actually tell what may be going wrong with the cookie. But judging by your descriptions, I'd venture to say the cookie code is fine as it works on most PC's with most profiles and users.

I suggest you take a look at IE8's history cleanup settings in the problem profiles, as it may be set too stringent, and be clearing out cookies very often.

Other than that, a look at how the cookie is being set, and how long it takes to expire in the problem user profiles may shed some light. Additionally clearing the cache, and cookies before logging in again may help.

Also make sure the PC's clocks are set correctly.

forum608 may be of more help.



----------------------------------
Phil AKA Vacunita
----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.

Behind the Web, Tips and Tricks for Web Development.

http://behindtheweb.blogspot.com/

 

[JonathanMortimer]

Thank you for your help Vacunita.

I don't think it can be a clock / date thing as this should also cause problems with IE7 / IE6.

How can I check how the cookies is being set and how long it takes to expire? I am not a PHP coder, even if I could get access to the code I wouldn't know what to look for or where to find it.

I will check the cookie clean-up settings.

 

[ingresman]

Depends how deep you are prepaired to go. I'd download a copy of fiddler which is the microsoft tool to do HTTP tracing, it's very good and free. Set this up and capture what is going from IE(all versions) back to server. The HTTP headers will have the cookie timeout info it. Have a try and post back (php joke !!) and let's have a look
(btw there is a version fiddler you can put on a client PC and it will capture the trace and you can then load it ito the full fiddler to analyse the traffic)

 

[jpadie]

occam's razor suggests that the browsers on the offending pc's have disabled the acceptance of session cookies.

 

[JonathanMortimer]

A few more things to try, thanks. Now it's just a matter of wrestling a machine off someone when it next happens...

 

[ingresman]

If cookies were disabled I would imagine other web sites would stop working. Try something like amazon and see if it remembers you. Or a test page which drops a cookie on the PC and a new session tries to read it.