4

Ok, I'm stumped. Here's the scenario: I have a .net 4.0 mvc3 app (razor) embedded in an iframe on a remote site. I have a standard Membership provider for security and everything works fine as long as I use Chrome or Firefox. However when I use ie9 (both in and out of compatibility mode) and safari (only tried 5.1.4) I get a System.NullReferenceException when trying to access Membership.GetUser() in another controller after logging in.

So I login successfully in my AccountController and redirect to my TravelController here:

public ActionResult LogOn(LogOnModel model, string returnUrl)
{
    try
    {
        if (ModelState.IsValid)
        {
            if (MembershipService.ValidateUser(model.UserName, model.Password))
            {
                FormsService.SignIn(model.UserName, model.RememberMe);
                log.Debug("User: " + model.UserName + " logged in."); 
                return RedirectToAction("Travel", "Travel");
            }
        }
    }
    catch(....

Now the app redirects to the TravelController which does the following:

public ActionResult Travel()
{
    try
    {
        string userName = Membership.GetUser().UserName;
        ... code ...
    }
    catch(Exception ex)
    {
        throw;
    }
}

So this all works fine in Chrome and Firefox, but when I try to run the same code using ie or safari the Membership object is null.

I have a feeling it is somehow related to the iframe, but I'm second guessing everything now. If I run it outside of iframe; meaning I call the url directly it runs in all browsers (that I've tried).

Any ideas? Thanks in advance.

1
  • 1
    Have you looked at p3p headers? Mar 28, 2012 at 21:47

1 Answer 1

2

Authentication is based on cookies. Internet Explorer doesn't allow 3rd party sites in an iframe to use cookies if they don't provide a machine readable privacy policy. See http://www.softwareprojects.com/resources/programming/t-how-to-get-internet-explorer-to-use-cookies-inside-1612.html and http://en.wikipedia.org/wiki/P3P for details.

So you should add an appropriate header to the site(s) and it should work fine.

Hope that helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.