Re: asp.net web farm configuration - (cookie domains?)

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Martin (x_at_y.z)
Date: 10/07/04 

Date: Thu, 7 Oct 2004 22:43:09 +0100

I guess I could write an HttpModule that modified the session and
authentication cookies, giving them the required cookie domain.

Would this work?

"Martin" <x@y.z> wrote in message
news:uH42kNLrEHA.3880@TK2MSFTNGP10.phx.gbl...
> I guess if the machines in the web farm would have the same domain name
(but
> different IPs of course), then the cookie domain issue would go away, but
I
> had wanted the machine with the https pages to have a different name than
> the other machines.
>
>
> "Martin" <x@y.z> wrote in message
> news:eq%234l4KrEHA.2776@TK2MSFTNGP14.phx.gbl...
> > I'm plannig an asp.net web farm.
> >
> > I expect to use a SQL database for session state management, ie.
> > <sessionState mode="SQLServer" cookieless="false" .../>
> >
> > My application uses web forms authentication, with a secure cookie, ie.
> > <authentication mode="Forms">
> > <forms name="mycookie" loginUrl=https://secure.domain.com
> > requireSSL="true"/>
> > </authentication>
> >
> > I expect different web applications on different web servers to be
> > associated with each other by virtue of using the same sessionState
> > settings.
> >
> > As indicated above, I would like to ensure that the pages requiring
> > authentication are grouped together, and as it happens I am thinking
that
> > all the https pages would be grouped on one machine, and only these
pages
> > require authenticated access.
> > So if I have 3 web servers, 1 and 2 would contain duplicate http pages
> > allowing anonymous access, whilst 3 would contain https pages requiring
> > authenticated access. All sharing the same session state, and being
part
> of
> > the same overall web application.
> >
> > I would use <location> and <authorization> elements to achieve at the
file
> > level, or just <authorization> element in web.config placed in specific
> sub
> > directories.
> >
> >
> > My question concerns cookies.
> > Do the session and authentication cookies get shared between the
different
> > servers in the web farm? I would expect to be able to specify the
cookie
> > domain somewhere, but I can't see where.
> >
> > Thanks to anyone who can fill in the gaps of this plan.
> > Martin
> >
> >
>
>

Relevant Pages

  • Re: authentication cookie vs session cookie
    ... level of using authentication cookies on the client machines. ... authentication cookie on a manager's machine is stolen and used on a client ... > session variables as it relies on the session cookie that ASP.NET sends to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: authentication cookie vs session cookie
    ... doing 'cookie' authentication (effectively what you are doing when you use ... session variables as it relies on the session cookie that ASP.NET sends to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Framework bug with Auth and Session state?
    ... So as long the browser stays open, ... cookie remains, ... the authentication never times out. ... Session info is stored on the server, using the session cookie only as an ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authentication question
    ... I also found the settings and chose to set a sliding timeout for the ... complained about having to login when I knew their session had not expired. ... > The session timeout and forms authentication cookie timeout are ... > authentication cookie but all of the inproc session state is gone. ...
    (microsoft.public.dotnet.framework.aspnet)
  • session.cookie_domain problem
    ... I have a small application that uses adodb and session for user ... management. ... when I try to assign a cookie domain ...
    (php.general)