Question

When I do a post one of the session variables is lost in IE.

This webapp works perfectly in Chrome and Firefox.

Here is the error:

NoMethodError at / 

undefined method `include?' for nil:NilClass
file: welcometo.rb
location: xml_file_to_use 
line: 19

Here is the method that errors:

def xml_file_to_use
   groups = allowed_groups
   #Which xml file should I write to
   if (session[:location_group].include? allowed_groups[0] ) <----Line 19
    ......
end

Here is an explanation and my code:

When the users log in, session variables are set:

#Check to see if the user is authorized
auth_token = Adauth.authenticate(params[:user], params[:password])
if auth_token 
    session[:user] = params[:user]
    session[:first_name] = auth_token.first_name.tr('/"[]', '') 
    session[:location_group] = (auth_token.groups & allowed_groups)
    redirect '/'
else 
    redirect '/login'
end

Next I set variables based on these session values:

get '/' do
  if session["user"] != nil
     @first_name = session[:first_name]
     @groups = session[:groups]
     @xml_file = xml_file_to_use 
     @location = location
     erb :form
  else 
    redirect '/login'
  end

end

This part works just fine. I can tell because I use the @location variable in my view.

Here is the location method:

#Setup Location Variable
def location
  if (session[:location_group].include? allowed_groups[0] ) <-- This same code errors during a post in IE
     return 'Eagan'
   else
     return 'Chicago'
   end  
end

Answer 1

Konstantin Haase is correct that this must be a bug.

From the link he posted I found that putting this at the top of my welcome.rb file fixes the issue:

set :protection, except: :session_hijacking