Re: Session ID in Query Parameter?

From: Uwe (ub_at_liant.com)
Date: 03/06/04 

Date: Fri, 5 Mar 2004 23:26:43 -0600

Hi Steven:

Thank you for your reply. My comments are interspersed below.

"Steven Cheng[MSFT]" <v-schang@online.microsoft.com> wrote in message
news:A$ETlqyAEHA.2300@cpmsftngxa06.phx.gbl...
> Hi Uwe,
>
> Thanks for posting in the community!
> From your description, you'd like to use the cookieless session in
> ASP.NETweb app. And the problem is that you've some non-ASP.NET/normal
html
> pages. So when posting from such normal html page the session state will
> lose(a new one start). Also, you'd like to looking for some certain
> appraches to resolve such problems, yes?
>
> As for this question, the ASP.NET buildin cookieless session support does
> lose some features that cookie-managed application provides. Those
> functions such as Form-based authentication, neat/custom urls, problems
> with mobile applications, or the ability to POST data from an html page
> become a thing of the past. Though the ASP.NET buildin hasn't provide some
> certain approachs on this, some other thiry-party members have tried some
> custom means to workaround this, here are some certain weblinks discusing
> on such topics:
>
> #Enabling POST in Cookieless ASP.NET Applications
> http://www.developer.com/net/asp/article.php/2216431

I had previously looked at this article, but it's a complex solution--not
from the implementation point of view, but I am concerned that there is
still a redirection involved. The browsers that I am supporting have
cookies disabled for security concerns, and I am concerned that they may
also have Javascript disabled. This solution uses Javascript to repost the
form data before the redirection.

> #Cookieless data persistence is possible
>
http://web.zdnet.com.au/builder/webdesign/scripting/story/0,2000040414,20273890,00.htm

Unfortunately, this article doesn't tell me how to use the ASP.NET Session
object in a cookieless way. I am trying to convert an existing "shopping
cart" ASP.NET program that is populated through the POST from various other
forms on the website. It uses the Session object and I really don't want to
change that.

> Also, since it's not the build in mechanism, it can't be guarantee that it
> won't work into any problem some time. In addition, I still think it
better
> to convert most pages into ASP.NET page (at least add mapping ) so as it
> also possbile to be handlered by ASP.NET runtime so that we can do some
> operations on those reponse stream.

Long-term, ASP.NET is the way to go. But like I said, others maintain the
HTML order forms in FrontPage that POST to the ASP.NET application. Less
work for me!

So, to restate the problem: there must be code in ASP.NET that takes the
session ID, looks for an existing session object and if found, connects to
it. If not found, it creates the object and session ID. I want to provide
the session ID string, rather than have the existing code read the session
ID string from the cookie.

Is there a place I can hook or subclass the code that creates/connects to
the session object?

--- Uwe

Relevant Pages

  • RE: Session not set.
    ... If so, it will never work properly, as the session cookie is never set. ... Checking Sessionfor login is an ASP model, ... If you TRULY want cookieless (setting session vars is not ... the Framework to handle your authentication needs, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How to do forms authentication with cookieless=UseUri?
    ... you are confusing session and authentication. ... forms authentication create a login ticket and stores it in a cookie or the ... this is because cookieless changes the url to have a login ticket. ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Security and cookieless sessions
    ... Cookieless sessions are designed to support certain protocols which don’t ... for personal reasons turn cookie persistence off in their browsers. ... surreptiously while the session was active, they could use it to spoof the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Major security issue?
    ... We have used cookieless sessions and what you say is true, ... client/server (ie. if connection broken, then the SSL session is invalid) so ... > would add some overhead to IIS because every HTTP request ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How To maintain Session state without cookies
    ... Cookieless session is supporting in ASP.NET, you just need to set this ... more details, refer this link ... Somebody know that good alternatives I have, in addition to the cookies, to maintain the session state? ... Agile Processes: "Assume that the most important factor in a project's success is the quality of the people on the project and how well they work together in human terms. ...
    (microsoft.public.dotnet.framework.aspnet)