IE8 losing session cookies in popup windows

Question

This is 'new' functionality in IE8!

Checkj out the IE8 blog below to read about it.

http://blogs.msdn.com/askie/archive/2009/03/09/opening-a-new-tab-may-launch-a-new-process-with-internet-explorer-8-0.aspx

IE8 can use multiple processes for handling an x number of IE windows. When you cross a process space, you loose your cookies (Asp.Net session ID seems to be retained over this process boundry).

I personally think it's broken or a bug. As we know, when browing to the 'same domain target' cookies should be maintained and resent. That IE8 has different processing behavior for security.. Great! that it is behaving badly and 'drops cookies even if going to the same target domain in another window' is just a bug in my view.

You can modify the number of processes IE8 uses through the internet explorer options ehh.. modifying a registry setting!!!!!! (this is what makes it a bug in my view. IE providing a UI to modify these settings would make it 'enterprise level acceptable'.

Regard,

Marvin Smit

There are multiple possibilities behind this -

• UAC & Vista (Had to crop up!!). Specifically, look for protected mode behavior.
• This could be an actual problem with the Session Merging feature in IE8. More so because opening a new window via the Ctrl+N shortcut causes the cookies to be magically sent in your case.
• An issue with an older build of IE (I know you have stated that your customers are using the latest build). You might want to check the details available at Microsoft Connect for bug IDs 408806 and 392032.

We solved this problem by changing the "Set tab process growth" to 0.

Although, we didn't have protected mode turned on and the zone was "Intranet". Evidently this is a problem/bug with Windows 7 64Bit as others have stated.

This page (#4) lead me to the solution: http://blog.httpwatch.com/2009/04/07/seven-things-you-should-known-about-ie-8/

Near as I can tell, another change to cookies across tabs just went live in this security update from November 12, 2013 that is breaking functionality in our app in all versions of IE. We're doing OpenID auth in a popup window so as to not have to redirect the user away from the page they were browsing when they first clicked the Login link. The session cookie for the login is correctly being sent down in the request in the popup window, but it never gets seen by the main browser window, so the next request to the server doesn't have that session cookie on it like it should, and thus logging in never actually works.

Does anyone have any possible solutions to this?