.NET Membership.GetUser () null in ie9 and safari when embedding in iframe

Question

OK, I'm at a standstill. Here's the scenario: I have a .net 4.0 mvc3 (razor) application embedded in an iframe on a remote site. I have a standard security membership provider and everything works fine while I use Chrome or Firefox. However, when I use ie9 (both in compatibility mode and out of compatibility mode) and safari (only when trying 5.1.4), I get a System.NullReferenceException when trying to access .GetUser () membership in another controller after logging in the system.

So, I successfully registered in my AccountController and redirected to my TravelController here:

public ActionResult LogOn(LogOnModel model, string returnUrl) { try { if (ModelState.IsValid) { if (MembershipService.ValidateUser(model.UserName, model.Password)) { FormsService.SignIn(model.UserName, model.RememberMe); log.Debug("User: " + model.UserName + " logged in."); return RedirectToAction("Travel", "Travel"); } } } catch(.... 

Now the application redirects to TravelController, which performs the following actions:

 public ActionResult Travel() { try { string userName = Membership.GetUser().UserName; ... code ... } catch(Exception ex) { throw; } } 

So, all this works fine in Chrome and Firefox, but when I try to run the same code using ie or safari, the Membership object is null.

I have a feeling that it is somehow related to the iframe, but now I guess everything all the time. If I run it outside the iframe; this means that I am calling url directly in all browsers (which I tried).

Any ideas? Thanks in advance.

Answer 1

Authentication is based on cookies. Internet Explorer does not allow third-party iframe sites to use cookies if they do not provide a machine-readable privacy policy. For more information see http://www.softwareprojects.com/resources/programming/t-how-to-get-internet-explorer-to-use-cookies-inside-1612.html and http://en.wikipedia.org / wiki / P3P .

So, you must add the appropriate header to the site (s), and it should work fine.

Hope this helps.