0

Got a weird one, on this site http://www.limbsandthings.com, Internet Explorer customers (all versions, even 10&11) are unable to search, add to their cart, and login to the control panel. Basically perform any form action without hitting the "This form has expired" CSRF error.

Chrome, Firefox, & Safari users aren't experiencing any issues.

I've tried setting the 'disable_csrf_protection' config setting (not ideal)

$config['disable_csrf_protection'] = "y";

However when that setting is enabled IE users aren't able to login at all (no error message occurs). They are able to perform other form actions.

I've even set a P3P cookie policy in .htaccess, thinking that maybe IE was somehow thinking our session cookie was third party. Setting IE's permission levels to Low doesn't seem to help either.

Another 2.9.2 site I manage for a client, http://www.jerseywatch.com is not experiencing any issues with IE.

Update: Viewing the cookies in Chrome vs. IE showed something interesting. The "exp_csrf_token" cookie is showing up when I inspect it in Chrome, however IE is reporting that the "exp_csrf_token" cookie doesn't exist.

Any ideas?

Improve this question
4
  • Can you copy paste the RAW response from the site? I'm thinking about checking the RAW headers for the cookie code. It doesn't make much sense that EE would not serve the cookie to IE though. Also check your Security settings in case you've got login as Session ID only...
    – Blatant
    Jun 9, 2015 at 16:06
  • Good idea, I checked the raw response and it looks like on IE the cookie is being set to expire at 10:00 AM GMT, so it's expired immediately.
    – Patrick Pohler
    Jun 9, 2015 at 16:19
  • Silly suggestion, have you checked your server time? What about the expiry on Chrome?
    – Blatant
    Jun 9, 2015 at 16:26
  • Not silly at all! Server time is indeed 8 hours off. What's weird is Chrome seems to have the correct expiration 17:00 GMT. I've contacted the host to see if there's a way we can get the time adjusted. Not sure if they're going to go for it.
    – Patrick Pohler
    Jun 9, 2015 at 17:04

1 Answer 1

Reset to default
0

Thanks to some great help from Blatant we traced it down to the server time. It was about 8 hours behind which was causing IE to set the exp_csrf_token to expire earlier than it should. Contacting the hosting provider and getting the server time fixed resolved the issue.

Improve this answer
2
  • Thanks Pat, glad you got it sorted! I think what your seeing is that Chrome and Firefox are rather 'forgiving' browsers correcting obvious errors for you (like missing closing tags, mis-matched tags, cookie expiries [apparently]), which is great for end users but a pain for devs, conversly IE doesn't do a stinkin thing to help you out! An unforgiving browser for sure! Please remember to mark this as the answer though (little tick to the left) when you can (there's a time limit I think)...
    – Blatant
    Jun 10, 2015 at 17:10
  • Funny you mention forgiving browsers, I remember over a decade ago Netscape (4?) would refuse to render a table or any HTML that wasn't properly formed while IE would take a best guess at it.
    – Patrick Pohler
    Jun 10, 2015 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.