Silverlight application denied access to domain service in Internet Explorer 10

Question

I am seeing a strange problem where my Silverlight application is failing to load due to an "Load operation failed for query.." and the reason is "Denied Access at System.ServiceModel.DomainServices.Server.DomainService.ValidateMethodPermissions"

If I browse to exactly the same page using IE 9 the request goes through and the silverlight application loads! This is happening on more than one server and their IIS and SQL Server have been configured the same as all other systems we set up.

With custom errors turned off I see the following stacktrace in Fiddler -

Denied Access@Detail@DomainServiceFaultDomainServices i)http://www.w3.org/2001/XMLSchema-instance@ ErrorCode��@ErrorMessage� Denied Access@IsDomainException�@ StackTrace�r at System.ServiceModel.DomainServices.Server.DomainService.ValidateMethodPermissions(DomainOperationEntry domainOperationEntry, Object entity) at System.ServiceModel.DomainServices.Server.DomainService.ValidateMethodCall(DomainOperationEntry domainOperationEntry, Object[] parameters, List1 validationResults) at System.ServiceModel.DomainServices.Server.DomainService.Query(QueryDescription queryDescription, IEnumerable1& validationErrors, Int32& totalCount) at System.ServiceModel.DomainServices.Hosting.QueryProcessor.Process[TEntity](DomainService domainService, DomainOperationEntry queryOperation, Object[] parameters, ServiceQuery serviceQuery, IEnumerable1& validationErrors, Int32& totalCount) at System.ServiceModel.DomainServices.Hosting.QueryOperationBehavior1.QueryOperationInvoker.InvokeCore(Object instance, Object[] inputs, Object[]& outputs)

The site is in my trusted sites.

When I attach to the silverlight application and debug the authentication process it seems to go through fine and the user is validated. But then when it actually tries to run the queries against the service subsequent to this they fail with access denied!

I'm lost as to why this would be any different in IE 10, any ideas would be appreciated! Thanks.

Answer 1

Not 100% proved this yet, but appears the hotfix suggested in this post - IE10 User-Agent causes ASP.Net to not send back Set-Cookie (IE10 not setting cookies) fixes the issue.

It seems there was a problem with IIS not handling IE10 cookies properly and so the authentication cookie was being set initially then subsequently ignored.

I'm guessing our machine was out of date, windows update-wise, as I presume this fix must have been distributed by now. But have yet to confirm.