SESSION variable being deleted in IE

Question

*Please don't ask me WHY about a lot of this code. I am running a site developed by someone else. A lot of it isn't the way I would do it, but it's the way it's currently done. Thank you before hand.

We have a simple application that allows users to search for courses at our school. Everything has been working pretty much fine with the app, but recently we upgraded our server to IIS 7 and Coldfusion 10. Since then, some users who use internet explorer cannot get the application to work, however the problem is not 100% widespread. Very sporadic in fact. I have narrowed it down to a single session variable [SESSION.location] being unset during the process, but cannot figure out where. I'll try to post relevant code below.

There is nothing in the Application.CFC that messes with this variable. There is a common header that handles the Form submissions.

<cftry>
        <cfset the_message = (structKeyExists(REQUEST, 'message')) ? REQUEST.message : (isDefined('submitFrmData')) ? submitFrmData() : ''>
        <cfif Len(Trim(the_message)) NEQ 0><div id="message">#the_message#</div></cfif>
    <cfcatch>#createObject('component','common.err_handler').pageErrHandler(CFCATCH)#</cfcatch>
    </cftry>

On the page the form is on to search for a course, I dumped the SESSION and I can see a SESSION.location that is set. The form's action is sent to a search_results.cfm page which has the following at the top.

public string function submitFrmData() {
    //Every time page loads.
    dal = CreateObject('component','cfcs.dal');
    if(structKeyExists(FORM, 'search_courses')){
        if (len(FORM.coursefinder_search) > 2 && arrayLen(REMatch("[%!@##$^&*()]", FORM.coursefinder_search)) < 1) { 
            if(structKeyExists(session, "location") && structKeyExists(session, "semester_id")){
                location('search_results.cfm?fsrch=' & APPLICATION.cFun.structToEncryptedString(FORM) & '&sem_id=#SESSION.semester_id#&loc_id=#SESSION.location#',false);
            } else {
                location("index.cfm", false);
            }
        } else if(structKeyExists(FORM, 'dept_id')){    
            if(structKeyExists(session, "location") && structKeyExists(session, "semester_id")){
                location('search_results.cfm?srch='& APPLICATION.cFun.structToEncryptedString(FORM) & '&sem_id=#SESSION.semester_id#&loc_id=#SESSION.location#',false);
            } else {
                location("index.cfm", false);
            }
        } else {
            location ("index.cfm", false);
        }
    }
    if(structKeyExists(URL, 'srch')){
        srch_result = dal.CrsSearch(APPLICATION.cFun.encStringToStruct(URL.srch));
        realResults = new query(dbtype="query", QoQsrcTable=srch_result, sql="SELECT DISTINCT COURSEID, sectioncode FROM QoQsrcTable").execute().getResult();
        numCoursesFound = (len(trim(realResults.courseid)) NEQ 0) ? realResults.recordCount : 0;
    }
    if(structKeyExists(URL, 'fsrch')){
        srch = APPLICATION.cFun.encStringToStruct(URL.fsrch);
        if(!structKeyExists(srch,'coursefinder_search')){
            location ("index.cfm", false);
        }
        srch_result = dal.CrsFreeSearch(srch.COURSEFINDER_SEARCH);
        realResults = new query(dbtype="query", QoQsrcTable=srch_result, sql="SELECT DISTINCT COURSEID, sectioncode FROM QoQsrcTable").execute().getResult();
        numCoursesFound = (len(trim(realResults.courseid)) NEQ 0) ? realResults.recordCount : 0;
    }

    return '';
}

So to me this is weird but this is what happens. The FORM is sent to the results page where the submitFrmData function is defined before the header is called. The header is called and the submitFrmData function is run. Once it gets in that function, I dump the SESSION and the SESSION.location is lost. Other SESSION variables remain, but location is lost. A lot of SESSION variables are set in the OnRequestStart function, which leads me to believe ALL SESSION variables are being lost and then reset on the OnRequestStart call.

But why would IE lose these variables on only some computers. The affected computers appears to be ones that accessed our application before the server upgrade, yet some still work fine. The computer I work on is fine in all versions of IE. I've tried clearing all cached data, etc. in IE with the problem still continuing.

I am getting a laptop in here today that has the issue and hopefully will be able to dump the SESSION all over the place until I find out exactly which step they get lost at, but it doesn't explain why its only on SOME computers running IE not all computers running IE. Could it be a OS issue?

Answer 1

We were running as a sub-domain. The main domain also used Coldfusion and used site-wide cookies that caused a conflict with ours. This caused the issue and it has since been resolved.