Re: Going sessionless (and cookie limitations)

I think you end up spending a great deal more time in solving the
cookieless problem than you would if you use a load balancer which
maintained sticky sessions.

The sticky sessions will ensure the same web user reaches the same
server in the web farm so the reconnect with the same session. You
will not have to deal with additional database load because your
sessions are local to each machine in the web farm, not shared with a
central database.

Most decent load balancer hardware supports sticky sessions.

After attempting force ASP.NET applications like survive in a
cookieless mode, I learned it is best to avoid it whenever possible.

Brennan Stehling
http://brennan.offwhite.net/blog/

Jon Davis wrote:
Does anyone know of a best practices or common practices article URL for
implementing a sessionless web farm while still managing user logins, etc.?

I just got hired by a company that told me their web site is sessionless to
cut down on the overhead of using SQL Server or a state server to host
session state information. I've been scratching my head to try to figure out
what the ramifications are, and what methodologies could be used to retain
common functionality such as user login support without imposing a security
risk.

I'm assuming cookies are used for the entire "session" but then my question
becomes what limitations still exist for cookies? Don't they support only a
very, VERY small name/value size and a very small record count?

Jon

.

Relevant Pages

  • Re: Major security issue?
    ... that make your car an insecure product? ... There is, real sessions, although that is arguable as well. ... > problematic since ASP first came about. ... Cookieless sessions are just an alternative. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Using useuri with security: Keep returning to login page
    ... I've tried turning off cookies in FireFox and turning on cookieless ... sessions in the forms element inside the authentication element (I set ... the cookieless attribute to UseUri). ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Cookieless Sessions (Sessions Without Cookies) and Security
    ... If someone can sniff your connection (no SSL) - there is no difference between cookies and cookieless security-wise. ... Some suggest that SSL is the cure all for cookieless sessions. ... or at least make them as secure as sessions with cookies? ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • CSS 11500 session log
    ... proxy server. ... I'd like to store in a log all the information about sessions (the ...
    (comp.dcom.sys.cisco)
  • Re: Role-based authentication and Forms and System.UnauthorizedAccessException
    ... yes - you can now do cookieless forms authentication, ... sessions, the authentication ticket gets mangled in the URL. ... >> Hello wrecker, ...
    (microsoft.public.dotnet.framework.aspnet.security)