Argh!
I woke up to a call telling me people couldn’t log into a site I’m developing. I hate those calls. A little poking around saw nothing abnormal until I tried IE (I use FF for development). Boom. Because of a fluke in my code, you COULD log in but the rest of the user session was missing. I tried Chrome. Same thing. I got a report that Safari was showing the problem too. But, FireFox? No problemo.
Thus began a few hours of debugging, testing, hammering a square peg into a round hole. I exhausted all the possibilities:
- server side code not writing the sessions properly (I’m a good coder, thank you very much)
- cookies not being passed back (same thing really)
- security settings (IE I could understand but Chrome? Safari?)
- server updates – Windows updates (No log of any updates in the last 24 hours)
- config changes (None admitted to but I trusted the sources…kinda)
Nothing. I had to take a break and I did. But, I was still mulling this stupid problem over and over. Cookies are being sent back. Not the server. But other people had the problem so it wasn’t one computer config or browser config. And IE and Chrome are so far apart in terms of code bases and development source I couldn’t imagine it was some related bug in both.
Searching the Web I found all sorts of people having cookie issues but none related to this situation. Usually it was just a bug in their code or they were expiring the cookie before it was sent, etc. Another thing was if I set the cookie to expire in a year it worked just fine (it’s our “remember me” function). So it was all about per-session cookies.
Then, as usual, an obscure reference somewhere (which I can’t find now, figures) where someone mentioned to another wanderer of the Web Development wastes that it could be the UTC time on the server is off. At first I thought, well, we’re not using UTC time. I had even looked at the trace (Fiddler is your friend) and noticed the GMT time wasn’t as far off as it was supposed to be. But, it didn’t make sense.
Until I checked the server’s time. It was four hours in the past. Ugh. I switched that bitch over to the official frigging US time and BOOM everything started working again. For fuck’s sake.
I can’t find it now but the same post or another one mentioned that FF handles invalid server times better than IE and the others because it just ignores the problem (after all, what’s the problem with a bad server time stamp on a response? At worst, you’re going to expire content sooner than you should…but that would just floor at “expire immediately” unless you’re an idiot and create a negative time and open up a security hole). Everyone else just says, “Oh, well, this is invalid. You’ll have to fill out a form FU-5491 and find some other browser that works.” Welcome to government agency programming.
So, the lesson: if you’re getting weird per-session cookie behavior, make sure one of the items you check off your debugging and troubleshooting list. Check the server’s time to make sure it’s not TOO far in the past. If possible, normalize against GMT/UTC to be sure you’re not miscalculating due to time zone differences between you and the server (assuming your server lives far from you).
I love wasting half a day on a stupid problem like this. Now to talk to support about that server’s clock…
out