2

Examples of the strange URL(s) that we get when this occurs: (note the long string before the /controller/ part)

http://domain.com/(F(RJ98SBleKwJwzM59cfA_Kr5pxNDeLW07xV65XfHzSqeZlZcgvl1TwHeH_s4rlWWPRo3dV9KGDati6kVlQ3o--KnVANIpqwvOB_H8cBO7MhPLXO2MIHITYUKnLp3DzKPwiQUOwaHa8fQpuXsbz1NIiuRICY4CaEBYhQ1qwkX64plaqhCGk6CG7Gk7WFB_Njq-XTtGDXLvcenSBZvMJ22Fgw2))/controller1/action1

http://domain.com/(F(ZbnIOH70BxAn2Eo6zzdH9zVWu4Oa7DrMaRk_tF41F3WcRapNeXghfDY0_f-2uYbPkWv1UV1ZyPp3tBPSM0I-UDbIyU2O_MKWPVcSg4D3uRo5kA6kRu7niobbJuPL5F8Gkc2g_a6mVhp_JGIRR4i1SRhyh8ovneMFzXHCGWU75TJogqlkjj5XTZNhG_LgqXHOy51Z92ueXjpLQdGh7b4kg_iixNPEn8qJHm_fudm-R8U1))/controller2/action2

I'm actually having trouble reproducing it since there doesn't seem to be a clear pattern on how it occurs. It occurs randomly for different controllers/actions and these actions can/may have different authorization attributes (we're authorizing based on Roles with ASP.NET Membership). I'm starting to think it's client-related, though, as when the user reports the issue, I'm able to log onto that same account and access those pages without an issue.

Symptoms:

  1. once logged out, user can't log back in
  2. strange url shown when attempting to log back in

Things that seem to fix it (from the user):

  1. clearing browser cache AND restarting Safari
  2. rebooting

Does anyone have a lead as to why that strange URL is being generated? Thanks in advance!

guest82
  • 123
  • 2
  • 1
    That URL contains [cookieless sessions](http://msdn.microsoft.com/en-us/library/aa479314.aspx). Is the users' browser possibly disabling cookies and then not re-enabling them until restarting the browser? – pjumble Feb 28 '12 at 19:35
  • Can you provide the code from logout mechanizm? – Peter Kiss Feb 28 '12 at 19:36
  • just as an added note, please don't use cookie-less (if there ever was any intention and not just a config issue) there are numerous security reasons why its bad – Adam Tuliper Feb 28 '12 at 20:52

1 Answers1

2

It's due to the cookieless feature in .net. So it's the forms authentication in the URL. Have a look at this question:

IIS7.5 ASP.NET MVC users hitting strange URLs: /(F(1xe9eXIxPz

Community
  • 1
  • 1
makit
  • 113
  • 9