Cookie Problem, Internet Explorer Only

Hehe, they’re just primary and secondary schools in the UK, but UK wide so firewalls will vary. Locally it’s Smoothwall, but I know there use alternatives in other council controlled areas. The majority of the UK education sector currently have their school internet provided via their local council (groups of towns, not sure what you’d call it elsewhere) under contract, but all vary their implementation.

I’m not sure it has anything to do with the firewall though as it happens at school and home for the users, including me obviously. I know it’s definitely something going on with my setup, but I’ve disabled it down to bare bones now with no plugins (mu included), twentyeleven theme on the main site, no object cache, php extensions disabled including opcache, varnish disabled, wp-config stripped to within an inch of it’s life. I’m at a loss now ?? Only solution is to pretend it’s not a subdomain network, until I need to add a new blog. I’m betting it’s something stupidly simple and a mistake on my part, or possibly something in the database that is skewing things.

Not sure why, but I’m getting a lot response cookies from the server when visiting the wp-login.php redirected page:

set-cookie:wordpress_sec_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpresspass_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:spo_5_fa=465b922cf006622ec4e0a812f7092e8c; expires=Wed, 18-Feb-2015 18:19:38 GMT; Max-Age=1800; path=/
set-cookie:wordpress_test_cookie=WP+Cookie+check; path=/; domain=domainhere.com; secure
set-cookie:wordpress_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpressuser_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpress_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/wp-content/plugins; domain=domainhere.com
set-cookie:wordpress_sec_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/wp-content/plugins; domain=domainhere.com
set-cookie:wordpress_logged_in_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpress_logged_in_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpress_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpress_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpress_sec_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpress_sec_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpressuser_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com
set-cookie:wordpresspass_randommd5stringhere=+; expires=Tue, 18-Feb-2014 17:49:38 GMT; Max-Age=-31536000; path=/; domain=domainhere.com

It can’t be a plugin as I disabled all of them again on both the network and normal admin plugin areas. I haven’t got cookies being set in any of my server configs either. I’ve grepped for the string but can’t find anything.

It’s also definitely not cached, I commented out the test cookie in wp-login.php and it removes that cookie from the response, so something is setting those cookies and I’m betting that’s confusing IE. Anyone got any ideas for tracking down what’s setting the cookies? I’ve grepped for setcookies and been through the entire install recursively, nothing in there looks out of order. Was hoping there’d be a debugbar extension for cookies but I can’t see anything.

Traced it back to wp-includes/pluggable.php and just commented them out to see if that let IE logins work, still nothing. I see that it kicks off the wp_clear_auth_cookie function in the wp-login.php, sending the request cookies through. Not seen it happen on anyone elses install though. The only two plugins that I have that use the wp_clear_auth_cookie function are User Switching and Domain Mapping, but I disabled them both and it still happens. So still not got anywhere ??

User Switching would be SLIGHTLY more suspect than Domain Mapping but neither really make me worry.

I’m not sure it has anything to do with the firewall though as it happens at school and home for the users, including me obviously.

Actually I meant is the server behind a proxy or something.

Ah, I’m using Varnish, but I’ve even piped it through and the same thing happens.

Weirdly… not what I meant, but kinda ??

I know a lot of schools will have a chain of servers where maindomain.com actually points three servers deep down to another, not for caching but for ‘security’ and isolation. What happens with that is you get domain.com loading from third.secret.internal.domain.com

Which can really bugger your cookies.

No, nothing like that. But that wouldn’t matter as it’s not working on any of my local Windows VMs at home either.

No, it would matter. Because all that would be on the inside/server side of things. Basically it would be that the cookies come from server A, when WP is actually on server B. More like Varnish, but with weirder setups. Like I said, though, I’ve just seen a lot of schools specifically do VERY weird things.

None of which seems to be applicable here! ??

I can’t think of what it might be except that you have a different home and site URL…

Ed –
Have you tried starting from scratch and slowly adding in configurations/plugins until you encounter the IE issue?

We have a couple of unique WP installations at USC and do not have any problems logging in with IE. I recently put WP 4.1 on AWS and did not encounter any IE login issues either.