Internet Explorer 11 won't set cookies on a site

Question

For some reason IE11 (only IE11, tested with other IE9 and IE10) won't create a session on a site i've been working on. So this means that a basic functionality such as site login won't work.

On other browsers this is working perfectly.

I researched a bit and found out that IE won't work with domains with underscore.. but my domain doesn't have one so what could be the problem? Thanks!

Answer 1

IE 11 does not like a domain value in the cookie. Leave it empty.

Wrong for IE 11:

Set-Cookie: kohanasession=foobar; expires=Tue, 09-Apr-2016 01:01:01 GMT; path=/; domain=tc.mk; httponly

Correct for IE 11:

Set-Cookie: kohanasession=foobar; expires=Tue, 09-Apr-2016 01:01:01 GMT; path=/; httponly

Answer 2

I know this is old, but hopefully this helps someone in the future. You cannot have a blank expires=; value in a cookie in IE11. You just have to leave the expires field out altogether.

Answer 3

This may only apply to another-domain cookies, but if someone finds this via Google (like I did) this may help.

IE11 may not set cookies depending on its Privacy settings.

This worked for me:

(Internet Options -> Privacy -> Advanced -> enable all cookie cases there)

Answer 4

I had this issue because I was running a single-page Vue application. I was setting the cookie in one route, then immediately routing to a different "page". However, it seems like IE won't send cookies until next page load. So instead of using pushState, I had to force the browser to re-load the page.

Answer 5

I recently had this problem myself. In my case, the problem was caused by executing the "ClearAuthenticationCache" command upon successful login. The command was executed to remove HTTP authentication, but it turns out that it will remove session cookies as well.

So I would recommend removing the "ClearAuthenticationCache" call if you executing it after a login.

document.execCommand("ClearAuthenticationCache");

For more information, please see the following link: https://blogs.msdn.microsoft.com/ieinternals/2010/04/04/understanding-session-lifetime/

Answer 6

Looking at the cookies your server is sending down the date of expiry seems to be yesterday. Is the date time set correctly on your server?

Answer 7

You are setting one of the session cookies twice: Set-Cookie: PHPSESSID=3iv5l4tn2ugkbf4vt09lilsi06; path=/ Set-Cookie: identity=1468380643; expires=Mon, 09-Jan-2017 12:31:46 GMT; path=/; domain=.tc.mk; httponly Set-Cookie: kohanasession=u5rrhtaj731h3p9s44jhp0k612; expires=Tue, 09-Feb-2016 12:31:46 GMT; path=/; domain=tc.mk; HttpOnly Set-Cookie: kohanasession=u5rrhtaj731h3p9s44jhp0k612; expires=Tue, 09-Feb-2016 12:31:46 GMT; path=/; domain=tc.mk; httponly

Internet explorer doesnt resend this cookie info on successive calls, while eg Chrome will just take one of the 'kohanasession'. Try sending the 'kohanasession' only once.

Also the domain you're setting in the cookie is 'tc.mk', while you have a SEO redirect to www.tc.mk. I think IE will not use the cookie for www in this case. Try configuring it to www.tc.mk

Answer 8

As Martin Beeby suggested, please check expiration of your cookie & set date time correctly on your server.

I have checked session for your site & in even chrome it's seems to be expired.

Seems some issue with cookie creation/expiration date & IE behaves different than chrome based browsers. Different cookies have different times than others.

Answer 9

I encountered a similar issue with a different setup, I'd like to share what the problem was and how I resolved it. Hoping it would provide ideas to solutions for those who suffer.

The Setup

1. Authentication service who sets auth cookies sitting on some-domain.com
2. React application bundled and ran by Webpack Server on localhost
3. Requests go through Webpack proxy to land on some-domain.com. For example

  '/api/': {
    target: 'some-domain.com',
    logLevel: 'debug',
    secure: false,
    changeOrigin: true,
    pathRewrite: {
    '^/api': '/api'
    }
  }

The Problem #1

Because my authentication service sets cookies on some-domain.com, and my React App was running on localhost, it doesn't have that cookie attached to its requests, and my authentication flow failed.

Solution

I had to rewrite the cookie domain, so I added this line to the proxy config on webpack

    cookieDomainRewrite: {
      '.some-domain.com': 'localhost'
    }

it looks like this in webpack.config.js

  devServer: {
    ...
    proxy: {
      '/api/': {
        target: 'some-domain.com',
        logLevel: 'debug',
        secure: false,
        changeOrigin: true,
        pathRewrite: {
          '^/api': '/api'
        },
        cookieDomainRewrite: {
          '.some-domain.com': 'localhost'
        }
      }
    }
    ...
  }

So this was fine on chrome, firefox... but broken in IE 11.

because IE 11 doesn't support the domain localhost for reasons mentioned in previous posts in this thread, when the rewrite happens, cookie is lost.

The final change I had to make was

   cookieDomainRewrite: {
      '.some-domain.com': null
    }

This will make the domain defaults to localhost while keeping it valid for IE 11.

Sum Up

when working with cookies and IE make sure:

1. your client and server's domain match
2. use null for domain value if working with localhost