IE8 Won't Always Edit Cookie Value

I've run into a problem where login on my site is not working consistently in IE8. It works fine in Firefox/Chrome/Safari but not IE8.

On first login everything is fine. After logging out and trying to log back in it usually fails for a while. It will end up redirecting to the login page against after authentication.

So the authentication is successful, it returns true, but it seems IE8 is not accepting the new value for the session id which we set by returning:

Set-Cookie SESSIONID=........; Path=/

in the response header. But obviously this works with a clear cache and I can get in fine. But after its already there it fails to reset, so after authenticating and attempting to go to a new page it sees this is an old session id being sent from the browser and redirects to the login page.

I haven't found anything here or elsewhere that really solves this (besides clearing the cache). Most references to IE8 cookie problems are language/framework specific and don't answer this problem.

Is there something special I might need to do with the set-cookie to make this work?

UPDATE:

I've set IE8 to prompt before accepting any cookie. When the login works fine it prompts as expected. When it does not work there isn't even a prompt to except the cookie..

UPDATE 2:

I should have mentioned that the cookie is开发者_StackOverflow社区 expected to be set after an ajax call:

$.get(authenticate_url, ....)

The url it requests a response from returns the header that sets the session id, then in the callback function the user is redirected to the main page -- assuming login is successful.

Is it a first party cookie or a 3rd party cookie. If the latter, ensure you're sending a P3P header. Are you setting the HTTPOnly attribute? Are you sure that the domain for the cookie is always the same? E.g. if you set the cookie when visiting "example.com" and tried to change it from "www.example.com" then you'll encounter problems.

I've hit similar symptoms when I have cookies set for both www.example.com and example.com. If there's no domain explicitly set, then session cookies get set for both.

However, higher-level domain cookies take precedence over the lower domian. So, if www.example.com tries to set a cookie, but example.com already has, then the example.com cookie stays in place and continues to apply for www.example.com.

There are two ways to approach this problem. One is not to allow access both with and without the www subdomain. Redirect one to the other. The second is to explicitly set the cookie domain, so that there aren't two versions lying around.

Of course, that might not actually be your issue. Experiment and find out :)