Underscores are Invalid in Host Names

The application I’m on uses cookies tied to a particular subdomain. The hostnames we were using for testing were of a format like subdomain_name.localhost.com Everything worked fine on Firefox, but we couldn’t authenticate from IE. Upon closer inspection we noticed that a new session ID was being generated for each request.

I started googling about “internet explorer new session each request” which led me me to this blog post which in the comments said something about “When using underscores, IE rejects the cookies”

So I went to wikipedia and the pertinent specs and lo and behold it turns out that underscores are illegal in hostnames.

1\. A “name” (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus sign (-), and period (.). Note that periods are only allowed when they serve to delimit components of “domain style names”. (See RFC-921, “Domain Name System Implementation Schedule”, for background). No blank or space characters are permitted as part of a name. No distinction is made between upper and lower case. The first character must be an alpha character. The last character must not be a minus sign or period. A host which serves as a GATEWAY should have “-GATEWAY” or “-GW” as part of its name. Hosts which do not serve as Internet gateways should not use “-GATEWAY” and “-GW” as part of their names. A host which is a TAC should have “-TAC” as the last part of its host name, if it is a DoD host. Single character names or nicknames are not allowed. \- RFC 922 (Page 1)

Who knew?

Well obviously a lot of people, but unfortunately I was not one of them.

So what happens if you do have underscores in your hostname? Firefox will work just fine. IE will find the server, and get pages, but reject any cookies because of the invalid hostname.

So if you ever find yourself with a new session on every request just for IE, make sure you aren’t using any underscores in your hostname.