SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently experiencing an issue on SP 2010 and anonymous sites. Sometimes I am unable to stay logged in.

On an anonymously accessible site, when trying to log into the site, the page seems to only refresh. Continuing to click sign-in will eventually get the user signed in. But after navigating around on the site or hitting refresh the user will go between being signed in and signed out. Visiting a different site within the same farm and from the same server results in the correct behavior and the user will stay signed in. Most of the time closing all IE windows and reopening the site will fix the issue. I have seen this issue happen on IE9 and IE8. Others have reported to me that the issue happens for them on Firefox and Chrome as well.

Here is a screen capture video I took of what happening:

Any thoughts on what could be happening here? I'm on SP 2010 Enterprise SP1 and using Windows Server Network Load Balancing with single client affinity.

share|improve this question
Sounds like you are seeing a variation of this old problem.… Don't know if anyone has ever been able to come up with an explanation or resolved it. – Paul Lucas Dec 12 '11 at 23:28
Interesting, thanks. – Steve Lineberry Dec 13 '11 at 1:03
up vote 0 down vote accepted

I believe we have determined the issue. It's a cookie conflict problem with WSS_KeepSessionAuthenticated.

We have a SP 2007 environment at which sets the cookie to be 443 (https port #).

We also have a SP 2010 environment which has anonymous access turned on and is what I was referring to in the question above. This environment sets the cookie to be a guid.

Since is a sub-domain of, both the guid and the 443 get sent to for the same cookie name because of sub-domain cookie sharing. I think the SP code in SP 2010 is only looking at the first value when checking for the cookie in the request and sometimes 443 is first and other times the guid is first in the cookie's namevaluecollection. Thus is shows a user as being logged out when the 443 happens to be first in the namevaluecollection and logged in when the guid is first.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.