# IE cookie/session problem

**URL:** <https://www.ruby-forum.com/t/ie-cookie-session-problem/64082>\
**Category:** Ruby\
**Created:** [June 21, 2006, 10:14pm UTC](https://www.ruby-forum.com/t/ie-cookie-session-problem/64082 "2006-06-21T22:14:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![markh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/7993a0/32.png) [@markh](https://www.ruby-forum.com/u/markh)\
**Post date:** [June 21, 2006, 10:14pm UTC](https://www.ruby-forum.com/t/ie-cookie-session-problem/64082/1 "2006-06-21T22:14:52Z")

</div>

We ran into an odd problem today regarding IE and cookies/sessions. We  
have  
one site running at the url '[dev.test.com](http://dev.test.com) ’ and another running at  
'[it.dev.test.com](http://it.dev.test.com)  
'. Both of these site are using the exact same codebase, on the same  
server.  
Both work just fine in Firefox. '[dev.test.com](http://dev.test.com) ’ works fine in IE,  
however ‘[it.dev.test.com](http://it.dev.test.com)’  
does not. Using ethereal, I noticed that IE was not sending the  
\_session\_id  
cookie back when using the url ’ [it.dev.test.com](http://it.dev.test.com) ’ though it does when  
using  
the url ‘[dev.test.com](http://dev.test.com)’. Has anyone ever run into IE having problems with  
cookies/session using a url like this?

Thanks for the help

---

<div class="post-metadata">

**Author:** ![markh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/7993a0/32.png) [@markh](https://www.ruby-forum.com/u/markh)\
**Post date:** [June 22, 2006, 4:29am UTC](https://www.ruby-forum.com/t/ie-cookie-session-problem/64082/2 "2006-06-22T04:29:49Z")

</div>

On 6/21/06, Mark Van H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> 

Yes. I seem to remember that this happened to us when we applied SP2.  
This problem usually crops up when you have an underscore in the  
domain name. This is wild guessing on my part (because I can’t find  
any definitive explanation) but I think IE thinks you’re sending a  
malformed url and doesn’t send the cookie as a security feature (on  
the other hand, it could just be a bug…). It’s possible that IE (or  
the programmer who added this ‘fix’) also objects to domain names of  
more than three components.

Regards,  
Sean