Cookies + Redirect = No Cookies

Never ever set a cookie in a 301 or 302 redirect.

This is a problem I've come across several times during my software career.

It's NOT possible to reliably set a cookie in a redirect. Most modern browsers will accept it, but some will not. In some cases you will be able to create a new cookie but not update it during a redirect.

I've come across problems with:

- Older versions of Internet Explorer
- Varnish
- Curl?
- Server-side frameworks such as CodeIgnitor

Another problem can be that the request is cancelled as part of server-side handling, before the cookie response is even sent to the client.

The solution

Instead of returning a 301 or 302 redirect, just print HTML and let the browser do the redirect instead

<meta http-equiv="refresh" content="0;URL=http://redirect-target.com" />

Comments

Popular posts from this blog

Switching from Docker Desktop to Rancher Desktop on WSL2: Solving the Missing docker-credential-desktop.exe Error

Running LXD/LXC on WSL2 with Ubuntu 20.04

Proxmox Remote administration via VNC