Cisco Cisco Web Security Appliance S670 Troubleshooting Guide

Contributed by Kei Ozaki and Siddharth Rajpathak, Cisco TAC
Engineers.

Jul 29, 2014

Why don't some webpages with short domain names like for example "ya.ru" open when using WSA in
transparent mode with authentication turned on along with 'cookie' surrogates?

Environment:

WSA with authentication enabled, cookie being used as surrogate type in either transparent or
forward mode with authentication or credential encryption enabled.

• 

Browsers IE6 or IE7

• 

Short (two−letter) domain name of destination. (Examples www.ya.ru, www.cn.ca)

• 

Symptoms: IE displays error page when browsing to page. Disabling authentication fixes this.

Note: This Knowledge Base article references software which is not maintained or supported by Cisco.  The
information is provided as a courtesy for your convenience. For further assistance, please contact the software
vendor.

IE6 and IE7 does not allow setting cookies for two−letter domain names as this could be a security risk,
because some Top Level Domains (TLDs) require an additional two−letter subdomain for any domain by
default and setting −2−letter cookies would mean that the cookie would be shared across any of those sites,
posing a security risk.

One example would be the domain: example.co.uk.

If one was to set a cookie for co.uk, it's contents would be sent to any of UK's commercial websites.

• 

This is an IE issue and there is nothing the WSA can do about it, because the cookie is necessary for
transparent authentication, especially with cookie surrogates. There is a registry key setting for IE6 to change
this behavior. The article below documents information about the registry setting:
http://support.microsoft.com/kb/310676