Sessions - cookieless for non-cookie users only

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Daniel Malcolm (daniel.malcolm_at_nup.jpigroup.com)
Date: 01/13/05 

Date: Thu, 13 Jan 2005 13:07:02 -0000

Hi

I just wanted to confirm that the "cookieless" attribute of the session
section of the web.config file is an "all or nothing" setting.

For some reason I thought that the following was the case:

If "cookieless" is set to false then ...

- If user's browser supports cookies then cookie is used to track Session
state
- If user's browser doesn't support cookies then cookieless mode (session id
added to url) is used to track Session state

but if "cookieless" is set to true then ...

- cookieless mode (session id added to url) is always used to track Session
state

I'm probably wrong though, as I've done a few tests and if I disable cookies
and set cookieless to "false" then Session state cannot be stored.

Thanks

Relevant Pages

  • RE: Session not set.
    ... If so, it will never work properly, as the session cookie is never set. ... Checking Sessionfor login is an ASP model, ... If you TRULY want cookieless (setting session vars is not ... the Framework to handle your authentication needs, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: How to do forms authentication with cookieless=UseUri?
    ... you are confusing session and authentication. ... forms authentication create a login ticket and stores it in a cookie or the ... this is because cookieless changes the url to have a login ticket. ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Security and cookieless sessions
    ... Cookieless sessions are designed to support certain protocols which don’t ... for personal reasons turn cookie persistence off in their browsers. ... surreptiously while the session was active, they could use it to spoof the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Session ID in Query Parameter?
    ... So when posting from such normal html page the session state will ... the ASP.NET buildin cookieless session support does ... It uses the Session object and I really don't want to ...
    (microsoft.public.dotnet.framework.aspnet)
  • page requires session state that is no longer available
    ... "The page requires session state that is no longer available. ... the one that I installed the mobile asp.net app under. ... cookieless is false (the phones we use ...
    (microsoft.public.dotnet.framework.aspnet.mobile)