Unable to read cookies in FireFox / Chrome through 302 redirect, but works in IE

Question

I rack my brains to figure out a problem with the browser (in Firefox and Chrome). I spent so much time trying to fix this problem, and finally I decided to create a demo for experts here to study this problem. (Hope it pays off)

I have two domains www.nkmekal.com and www.incessantcoding.com

Please use Firefox / Chrome to replicate the problem:

Step 1:

Overview of http://www.nkmekal.com/createcookie.aspx

The page only creates a cookie. Below is the code that creates the cookie:

// In On_Load of nkmekal.com/createCookie.aspx HttpCookie cookie = new HttpCookie("DisCookie"); cookie.Value = "djdjd77676ydjdndgdidjkdnhf"; cookie.HttpOnly = true; cookie.Expires = DateTime.Now.AddDays(1); Response.Cookies.Add(cookie); lblCookieInfo.Text = string.Format("<b>Cookie Name:</b> {0} <br/><br/> <b>Cookie Value:</b> {1} <br/><br/> <b>Cookie Expires On:</b> {2}", cookie.Name, cookie.Value, cookie.Expires); 

Step 2:

Now open a new tab in the browser, go to http://www.incessantcoding.com/GoTonkmekal.aspx , which basically does a simple 302 redirect to http://www.nkmekal.com/ReadCookie.aspx below is the code that does this redirect:

 // In On_Load of incessantcoding.com/GoTonkmekal.aspx protected void Page_Load(object sender, EventArgs e) { Response.Redirect("http://www.nkmekal.com/ReadCookie.aspx"); } 

However, I see the following message: (see the code for the ReadCookie.aspx page in step 3)

"No Cookie Found :("

This means that the domain www.nkmekal.com was not able to read the cookie that was created earlier when you browsed www.nkmekal.com/createcookie.aspx

Step 3:

And the page http://www.nkmekal.com/ReadCookie.aspx just tries to read the cookie created above (in step 1) and displays the cookie data. Below is the code that tries to read the cookie and displays it on the page

  // In On_Load of nkmekal/ReadCookie.aspx HttpCookie cookie = Request.Cookies["DisCookie"]; if (cookie != null) { // Resetting expiry date because the browser never sends expiry date to Server, // as cookies expiration dates are irrelevant to servers. cookie.Expires = DateTime.Now.AddDays(1); lblCookieInfo.Text = string.Format("<b>Yes! I found a cookie</b> <br><br><b>Cookie Name:</b> {0} <br/><br/> <b>Cookie Value:</b> {1} <br/><br/> <b>Cookie Expires On:</b> {2}", cookie.Name, cookie.Value, cookie.Expires); } else { lblCookieInfo.Text = "No Cookie Found :("; } 

The above steps only work in IE, but not in FireFox / Chrome.

In addition, if you want to look into the source code of two domains, you can upload them to

http://dl.dropbox.com/u/1248159/incessantcoding.zip

http://dl.dropbox.com/u/1248159/nkmekal.zip

Why am I trying to do this:

So, the reason I am trying to do this is because certain operations must be performed on the www.incessantcoding.com domain if a cookie was created that was created at www.nkmekal.com

And the reason for the 302 redirect is because we cannot read cookies with cross domains, and therefore I am trying to get cookies read only from the corresponding domain (since nkmekal.com can only read its cookies).

Any help / suggestions would be very helpful.

Update: It is also quite interesting if steps 1 and 3 are performed (excluding step 2), the cookie value is read correctly in Firefox and Chrome. Its only 302 way that doesn't work.

Answer 1

I finally figured out the alternative, and everything works fine! Here is what I did:

If nkmekal.com creates a DisCookie ... I send a 302 redirect to incesscantcoding.com with an encrypted token as a querystring value, then incessentcoding.com will create its own DisCookie based on the querystring value for its domain, so if I want to know if the file exists cookie for nkmekal.com I'll just look at the DisCookie Cookies collection at incessantcoding.com . I tested this script and it seems to work in both firefox and chrome ...

And later I realized that even Google does a similar thing when a user logs into one of their service sites ...

Hope this helps ...

Answer 2

When a cookie is saved, the website’s domain is also saved - this is done to avoid cross-domain data exchange, which means: after a cookie is saved from one host, it CANNOT be read from another.

but you can pass cookie data through the URL of your source host:

 protected void Page_Load(object sender, EventArgs e) { HttpCookie cookie = Request.Cookies["DisCookie"]; if (cookie != null) { Response.Redirect("http://www.nkmekal.com/ReadCookie.aspx?data=" + cookie.Value); } else Response.Redirect("http://www.nkmekal.com/ReadCookie.aspx"); } 

And then just use data in ReadCookie.aspx.