session lost on redirect

Question

I have a web app that is being hit by facebook. The login page retrieves the keys that I need and sets some session variables. When the server then redirects the user to the next page, the session information is lost. I’m running the IIS engine on vista ultimate at the moment, the app pools don’t matter because I’m using a state service and I’m still losing the session state. I’ve tried both the overloaded method of the response.redirect function and also adding a header to the page to force the redirect and none of this seems to work. Does anyone have any ideas of what I’m missing?

I’ve tried both of these:

Response.Headers.Add("refresh", "3;url=Dashboard.aspx")

And

Response.Redirect("Dashboard.aspx", False)

[EDIT]

So i just did a little experiment and well it turns out that when I hit the url directly from the facebook page I get the problem, but when i copy the url for the IFrame into a new browser window and try it it works fine.

[EDIT]

So I found an article on this and after addin gthe header the problem was solved (for now)

http://support.microsoft.com/kb/323752

Response.AddHeader("P3P: CP", "CAO PSA OUR")

Answer 1

The session depends also on cookie support by the client. When you say the app "is being hit by facebook" are you sure that by what ever means they are "hitting" you they are supporting cookies?

Answer 2

I'd try running Fiddler and see if your session cookie is being sent properly with the response when interacting with your app via Facebook.

Answer 3

when I hit the url directly from the facebook page I get the problem, but when i copy the url for the IFrame into a new browser window and try it it works fine.

If you're in an iframe, any cookies you set are “third-party cookies”. Third-party cookies may be subject to more stringent conditions than the normal “first-party” cookies you are setting when the user is directly on your site. This can be due to different browser default cookie handling or because the user has deliberately configured it like that. (And for good reason: many third-parties are unpleasant privacy-invading advertisers.)

In particular, in IE6+ with the default settings, you cannot set a third-party cookie unless you write a P3P policy promising that you will be a good boy and not flog your users' data to the nearest identify thief.

(In practice of course P3P is a dead loss, since there's nothing stopping the site owner from just lying. Another worthless complication that provides no actual security. Yay.)

Answer 4

Response.Redirect and refresh don't carry session. Server.Transfer() can but loses the ability to transfer to other servers/sites.