Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I'm currently experiencing an issue on SP 2010 and anonymous sites. Sometimes I am unable to stay logged in.

On an anonymously accessible site, when trying to log into the site, the page seems to only refresh. Continuing to click sign-in will eventually get the user signed in. But after navigating around on the site or hitting refresh the user will go between being signed in and signed out. Visiting a different site within the same farm and from the same server results in the correct behavior and the user will stay signed in. Most of the time closing all IE windows and reopening the site will fix the issue. I have seen this issue happen on IE9 and IE8. Others have reported to me that the issue happens for them on Firefox and Chrome as well.

Here is a screen capture video I took of what happening: https://partners.myskanska.com/Shared%20Documents/ScreenCapture_11-30-2011%2010.28.13%20AM.wmv

Any thoughts on what could be happening here? I'm on SP 2010 Enterprise SP1 and using Windows Server Network Load Balancing with single client affinity.

share|improve this question
    
Sounds like you are seeing a variation of this old problem. sharepoint.stackexchange.com/questions/2026/… Don't know if anyone has ever been able to come up with an explanation or resolved it. –  Paul Lucas Dec 12 '11 at 23:28
    
Interesting, thanks. –  Steve Lineberry Dec 13 '11 at 1:03
add comment

1 Answer

up vote 0 down vote accepted

I believe we have determined the issue. It's a cookie conflict problem with WSS_KeepSessionAuthenticated.

We have a SP 2007 environment at https://company.com which sets the cookie to be 443 (https port #).

We also have a SP 2010 environment https://partners.company.com which has anonymous access turned on and is what I was referring to in the question above. This environment sets the cookie to be a guid.

Since partners.company.com is a sub-domain of company.com, both the guid and the 443 get sent to partners.company.com for the same cookie name because of sub-domain cookie sharing. I think the SP code in SP 2010 is only looking at the first value when checking for the cookie in the request and sometimes 443 is first and other times the guid is first in the cookie's namevaluecollection. Thus is shows a user as being logged out when the 443 happens to be first in the namevaluecollection and logged in when the guid is first.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.