Lasso 8.5.6[WK3] IE8 Session Bug?

classic Classic list List threaded Threaded
10 messages Options
Reply | Threaded
Open this post in threaded view
|

Lasso 8.5.6[WK3] IE8 Session Bug?

Jon Harris
Hi List

I am having some wierd problem with Lasso sessions and IE8.

See the following pretty simple code:

<?LassoScript
 
var: 'site'='testsite' ;
var: 'sessionname'=$site+'user';
session_start: -Name=$sessionname,-Expires=60;
var: 'sessionid'=(Session_ID: -Name=$sessionname);
?>
*[$sessionid]*

If I change the sitename to:
var: 'site'='Testsite' ;

- Just change the case of the first letter and refresh the page.

Now every time I refresh the page I get a new session id. I can
understand it changing once but not to keep changing thereafter. Its
almost as if IE says I have got that session name, but I can't give it
to you.

Don't have the problem in Firefox, so is this a bug in IE8?

Anyone else able to replicate this?

Jon Harris




--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/


Reply | Threaded
Open this post in threaded view
|

Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Bil Corry-3
Jon Harris wrote on 4/23/2010 9:16 AM:
> Now every time I refresh the page I get a new session id. I can
> understand it changing once but not to keep changing thereafter. Its
> almost as if IE says I have got that session name, but I can't give it
> to you.

That means IE8 is not sending back the session cookie.


- Bil

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/


Reply | Threaded
Open this post in threaded view
|

Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Jon Harris
In reply to this post by Jon Harris
Hi Bil

Thank for post back.

That's what I can see - but is this a Lasso or IE8 problem?

Were you able to replicate the issue?

Regards
Jon




-----Original Message-----
From: Lasso Talk [mailto:[hidden email]] On Behalf Of Bil
Corry
Sent: 24 April 2010 06:23
To: Lasso Talk
Subject: Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Jon Harris wrote on 4/23/2010 9:16 AM:
> Now every time I refresh the page I get a new session id. I can
> understand it changing once but not to keep changing thereafter. Its
> almost as if IE says I have got that session name, but I can't give it

> to you.

That means IE8 is not sending back the session cookie.


- Bil

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/



--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/


Reply | Threaded
Open this post in threaded view
|

Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Bil Corry-3
You said it worked in other browsers, so that tells me that Lasso is sending a cookie header (you can sniff the wire using WireShark to confirm), but for some reason IE8 is not accepting the cookie.  Probably a setting, maybe a P3P issue.


- Bil


Jon Harris wrote on 4/24/2010 1:43 AM:

> Hi Bil
>
> Thank for post back.
>
> That's what I can see - but is this a Lasso or IE8 problem?
>
> Were you able to replicate the issue?
>
> Regards
> Jon
>
>
>
>
> -----Original Message-----
> From: Lasso Talk [mailto:[hidden email]] On Behalf Of Bil
> Corry
> Sent: 24 April 2010 06:23
> To: Lasso Talk
> Subject: Re: Lasso 8.5.6[WK3] IE8 Session Bug?
>
> Jon Harris wrote on 4/23/2010 9:16 AM:
>> Now every time I refresh the page I get a new session id. I can
>> understand it changing once but not to keep changing thereafter. Its
>> almost as if IE says I have got that session name, but I can't give it
>
>> to you.
>
> That means IE8 is not sending back the session cookie.
>
>
> - Bil

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/


Reply | Threaded
Open this post in threaded view
|

Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Jonathan Vanherpe (T & T NV)
In reply to this post by Jon Harris
Hey Jon,

You might be able to figure out what's going on by using fiddler
(http://www.fiddler2.com/fiddler2/). It's basically a proxy that allows
you to see what headers are sent and received through IE (and firefox if
you install the extension).

Jonathan

Jon Harris wrote:

> Hi List
>
> I am having some wierd problem with Lasso sessions and IE8.
>
> See the following pretty simple code:
>
> <?LassoScript
>
> var: 'site'='testsite' ;
> var: 'sessionname'=$site+'user';
> session_start: -Name=$sessionname,-Expires=60;
> var: 'sessionid'=(Session_ID: -Name=$sessionname);
> ?>
> *[$sessionid]*
>
> If I change the sitename to:
> var: 'site'='Testsite' ;
>
> - Just change the case of the first letter and refresh the page.
>
> Now every time I refresh the page I get a new session id. I can
> understand it changing once but not to keep changing thereafter. Its
> almost as if IE says I have got that session name, but I can't give it
> to you.
>
> Don't have the problem in Firefox, so is this a bug in IE8?
>
> Anyone else able to replicate this?
>
> Jon Harris
>
>
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>
>


--
Jonathan Vanherpe - Tallieu & Tallieu nv - [hidden email]

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/


Reply | Threaded
Open this post in threaded view
|

Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Bil Corry-3
Jonathan Vanherpe (T & T nv) wrote on 4/25/2010 11:56 PM:
> You might be able to figure out what's going on by using fiddler
> (http://www.fiddler2.com/fiddler2/). It's basically a proxy that allows
> you to see what headers are sent and received through IE (and firefox if
> you install the extension).

Or Burp is another proxy:

        http://portswigger.net/suite/download.html

- Bil

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/


Reply | Threaded
Open this post in threaded view
|

Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Jon Harris
In reply to this post by Jon Harris
Hi Jonathan

I'll have a go with Fiddler.IE. I don't have the problem with Firefox,
so it does look like an IE8 bug, but it could also be a bug in Lasso.

Regards
Jon



-----Original Message-----
From: Lasso Talk [mailto:[hidden email]] On Behalf Of
Jonathan Vanherpe (T & T nv)
Sent: 26 April 2010 07:57
To: Lasso Talk
Subject: Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Hey Jon,

You might be able to figure out what's going on by using fiddler
(http://www.fiddler2.com/fiddler2/). It's basically a proxy that allows
you to see what headers are sent and received through IE (and firefox if
you install the extension).

Jonathan

Jon Harris wrote:

> Hi List
>
> I am having some wierd problem with Lasso sessions and IE8.
>
> See the following pretty simple code:
>
> <?LassoScript
>
> var: 'site'='testsite' ;
> var: 'sessionname'=$site+'user';
> session_start: -Name=$sessionname,-Expires=60;
> var: 'sessionid'=(Session_ID: -Name=$sessionname); ?>
> *[$sessionid]*
>
> If I change the sitename to:
> var: 'site'='Testsite' ;
>
> - Just change the case of the first letter and refresh the page.
>
> Now every time I refresh the page I get a new session id. I can
> understand it changing once but not to keep changing thereafter. Its
> almost as if IE says I have got that session name, but I can't give it

> to you.
>
> Don't have the problem in Firefox, so is this a bug in IE8?
>
> Anyone else able to replicate this?
>
> Jon Harris
>
>
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/ 
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>
>


--
Jonathan Vanherpe - Tallieu & Tallieu nv - [hidden email]

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/



--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/


Reply | Threaded
Open this post in threaded view
|

Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Jon Harris
In reply to this post by Jon Harris
Hi Bil

Thanks for your posting. Wireshack is a good idea - I'll give it a go
later today.

I was interested to know if this was an IE8 and/or a Lasso problem. I
was wondering if anyone on the list was able to replicate the issue and
see if PHP/.Net/CF environments have the same problem.

Regards

jon

-----Original Message-----
From: Lasso Talk [mailto:[hidden email]] On Behalf Of Bil
Corry
Sent: 24 April 2010 18:58
To: Lasso Talk
Subject: Re: Lasso 8.5.6[WK3] IE8 Session Bug?

You said it worked in other browsers, so that tells me that Lasso is
sending a cookie header (you can sniff the wire using WireShark to
confirm), but for some reason IE8 is not accepting the cookie.  Probably
a setting, maybe a P3P issue.


- Bil


Jon Harris wrote on 4/24/2010 1:43 AM:

> Hi Bil
>
> Thank for post back.
>
> That's what I can see - but is this a Lasso or IE8 problem?
>
> Were you able to replicate the issue?
>
> Regards
> Jon
>
>
>
>
> -----Original Message-----
> From: Lasso Talk [mailto:[hidden email]] On Behalf Of Bil
> Corry
> Sent: 24 April 2010 06:23
> To: Lasso Talk
> Subject: Re: Lasso 8.5.6[WK3] IE8 Session Bug?
>
> Jon Harris wrote on 4/23/2010 9:16 AM:
>> Now every time I refresh the page I get a new session id. I can
>> understand it changing once but not to keep changing thereafter. Its
>> almost as if IE says I have got that session name, but I can't give
>> it
>
>> to you.
>
> That means IE8 is not sending back the session cookie.
>
>
> - Bil

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/



--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/


Reply | Threaded
Open this post in threaded view
|

Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Rick Draper-2
In reply to this post by Jon Harris
Hi Jon,

As Bil indicated, it is most likely an IE8 security setting, which will be
"bug like" if the settings need to be changed for your solution to work.

We have a solution that uses session cookies (lasso 8.5.5) and it works fine
for IE as we have it configured on our workstations.

Very best regards,

Rick

-----Original Message-----
From: Lasso Talk [mailto:[hidden email]] On Behalf Of Jon Harris
Sent: Monday, 26 April 2010 6:08 PM
To: Lasso Talk
Subject: Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Hi Jonathan

I'll have a go with Fiddler.IE. I don't have the problem with Firefox, so it
does look like an IE8 bug, but it could also be a bug in Lasso.

Regards
Jon



-----Original Message-----
From: Lasso Talk [mailto:[hidden email]] On Behalf Of Jonathan
Vanherpe (T & T nv)
Sent: 26 April 2010 07:57
To: Lasso Talk
Subject: Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Hey Jon,

You might be able to figure out what's going on by using fiddler
(http://www.fiddler2.com/fiddler2/). It's basically a proxy that allows you
to see what headers are sent and received through IE (and firefox if you
install the extension).

Jonathan

Jon Harris wrote:

> Hi List
>
> I am having some wierd problem with Lasso sessions and IE8.
>
> See the following pretty simple code:
>
> <?LassoScript
>
> var: 'site'='testsite' ;
> var: 'sessionname'=$site+'user';
> session_start: -Name=$sessionname,-Expires=60;
> var: 'sessionid'=(Session_ID: -Name=$sessionname); ?>
> *[$sessionid]*
>
> If I change the sitename to:
> var: 'site'='Testsite' ;
>
> - Just change the case of the first letter and refresh the page.
>
> Now every time I refresh the page I get a new session id. I can
> understand it changing once but not to keep changing thereafter. Its
> almost as if IE says I have got that session name, but I can't give it

> to you.
>
> Don't have the problem in Firefox, so is this a bug in IE8?
>
> Anyone else able to replicate this?
>
> Jon Harris
>
>



--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/


Reply | Threaded
Open this post in threaded view
|

Re: Lasso 8.5.6[WK3] IE8 Session Bug?

Bil Corry-3
In reply to this post by Jon Harris
Jon Harris wrote on 4/26/2010 1:18 AM:
> I was interested to know if this was an IE8 and/or a Lasso problem. I
> was wondering if anyone on the list was able to replicate the issue and
> see if PHP/.Net/CF environments have the same problem.

Check the IE settings:

        Tools > Internet Options > Privacy tab

What is it set to?

To test if it's an IE setting, try explicitly allowing all cookies.  From the Privacy tab, click on the "Advanced" button, tick "Override automatic cookie handling" and select "Accept" for both 1st and 3rd party cookies and tick "Always allow session cookies".  Then try your session test again.  Does it work?  If so, then you're doing something IE doesn't like by default (probably a lack of a P3P header).


- Bil

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/