Cookies + Redirect = No Cookies
Never ever set a cookie in a 301 or 302 redirect.
This is a problem I've come across several times during my software career.
It's NOT possible to reliably set a cookie in a redirect. Most modern browsers will accept it, but some will not. In some cases you will be able to create a new cookie but not update it during a redirect.
I've come across problems with:
- Older versions of Internet Explorer
- Safari? See Stackoverflow.com question
- Varnish
- Curl?
- Server-side frameworks such as CodeIgnitor
Another problem can be that the request is cancelled as part of server-side handling, before the cookie response is even sent to the client.
The solution
Instead of returning a 301 or 302 redirect, just print HTML and let the browser do the redirect instead
<meta http-equiv="refresh" content="0;URL=http://redirect-target.com" />
Comments
Post a Comment