Interesting IE 302 Redirection Issue

Yesterday I helped a coworker track down an interesting issue with 302 URL redirection in IE that I thought I'd share. Here is a brief run down of what my co-worker was observing:

  • Users would log into a courseware application, setting a single sign-on cookie. For the purposes of this description lets say the URLwas https://sitea.domain.com.
  • Users would then link out to a related application covered by the single sign-on. Lets say the URL for this related application was https://siteb.domain.com/appa.
  • When users clicked the link in Internet Explorer, instead of being logged in to the related application users were being redirected back to a non existent page in the courseware application, https://sitea.domain.com/appa/index.cfm.

What was interesting about this was that everything worked fine in Firefox, only IE seemed to be having this problem. Realizing the issue probably had something to do with the handling of the SSO in the linked-to application I fired up a proxy (ServiceCapture in this case) to watch the login process. Here is what I saw:

  • When users clicked the "link" in the courseware application they were actually being forwarded to the target application via a 302 HTTP header:

    HTTP/1.1 302 Found
    Location: https://siteb.domain.com/appa/

  • That redirection was immediately followed by another 302 redirection:

    HTTP/1.1 302 Found
    Location: /appa/index.cfm

Looking at the code of the linked-to application I could see that after logging in, which happens automatically on the first visit if the user has the appropriate SSO cookie, the application redirected users back to the home page using a relative URL. The issue was that IE was was calculating this relative URL using the base URL of the original request, https://sitea.domain.com in this example, and not taking into consideration the intermediate redirection to https://siteb.domain.com/appa. Firefox seemed to do a "better" of job of keeping track of which base URL to use for calculating relative URLs. I say "better" because Firefox's behavior seems to make more sense to me.

So there you have it, another reason to love IE.

Comments
Eric Tice's Gravatar This is a great post. I am having the same issue. Can you please describe how you fixed this issue?
# Posted By Eric Tice | 4/8/10 2:56 PM
Nathan Mische's Gravatar @Eric - Sorry for the late reply. I was on vacation and must have missed this comment. The solution was to use an absolute location (https://siteb.domain.com/appa/index.cfm) instead of a relative location(/appa/index.cfm) in the relocation.
# Posted By Nathan Mische | 4/21/10 7:47 PM
BlogCFC was created by Raymond Camden. This blog is running version 5.8.001.