Got a weird one, on this site http://www.limbsandthings.com, Internet Explorer customers (all versions, even 10&11) are unable to search, add to their cart, and login to the control panel. Basically perform any form action without hitting the "This form has expired" CSRF error.
Chrome, Firefox, & Safari users aren't experiencing any issues.
I've tried setting the 'disable_csrf_protection' config setting (not ideal)
$config['disable_csrf_protection'] = "y";
However when that setting is enabled IE users aren't able to login at all (no error message occurs). They are able to perform other form actions.
I've even set a P3P cookie policy in .htaccess, thinking that maybe IE was somehow thinking our session cookie was third party. Setting IE's permission levels to Low doesn't seem to help either.
Another 2.9.2 site I manage for a client, http://www.jerseywatch.com is not experiencing any issues with IE.
Update: Viewing the cookies in Chrome vs. IE showed something interesting. The "exp_csrf_token" cookie is showing up when I inspect it in Chrome, however IE is reporting that the "exp_csrf_token" cookie doesn't exist.
Any ideas?