Session with multiple user

Hi Anoop

If you set Session to cookieless="true", then ASP.NET must put the Session identifier into your URL, because there is simply no other place it can do it.

So when cookieless="false" ASP.NET store Session identifier in dedicated cookie, and when cookieless="true" in URL.

ASP.NET offers six different options for cookieless attribute.

UseCookies - This is default option, set in machine.config file. ASP.NET website will use cookies to store session id, even if client doesn't support them. In case that client refuse to save cookie, session data will be lost and new session is created for each request. Thus, clients without cookie support can't use web application.

false - has same meaning as UseCookies.

UseUri - Website will embed session id inside of all relative URLs. ASP.NET Session State will never use cookies, even if client browser supports them. Sessions will work on each client, but could be less secure than session with cookie.

true - same as UseUri.

UseDeviceProfile - ASP.NET will check client if it's capable to support cookies. If client can support cookies, cookie will be used to store session id. Notice that this method just checks browser's features, but it doesn't consider an option that user is manually disabled cookies in browser. If web browser application supports cookies but user is disabled them, session will not work.

AutoDetect - ASP.NET will automatically detect if client supports cookies or not. If client supports cookies, website will use a cookie as storage for session id. If client doesn't support cookies, ASP.NET will embed session id in page URL. This looks as good compromise, although could cause problems with search engines.

Cookieless sessions and RegenerateExpiredSessionId parameter

To enable cookieless session, it is enough to set appropriate value for cookieless parameter. But, sessionState element contains RegenerateExpiredSessionId parameter which is important for security reasons. RegenerateExpiredSessionId could have two values:

True - Expired session ids can't be used again. If visitor comes to website using old session id, it will be replaced with new session id

False - If visitor uses old session id to visit website (e.g. through a bookmark, search engines, social networks etc.), website will create new session collection but session id will stay same.

For security reasons, especially with cookieless sessions, is better to always use RegenerateExpiredSessionId="True". On this way expired session id will not be used for new session, to avoid that different visitors have same session id.

Read its description here

http://msdn.microsoft.com/en-us/library/h6bb9cz9%28VS.71%29.aspx

1 Reply

Know the answer? Post it — somebody with the same question will find it here.

Brajesh Kumar8y ago
Hi Anoop

If you set Session to cookieless="true", then ASP.NET must put the Session identifier into your URL, because there is simply no other place it can do it.

So when cookieless="false" ASP.NET store Session identifier in dedicated cookie, and when cookieless="true" in URL.
ASP.NET offers six different options for cookieless attribute.
UseCookies - This is default option, set in machine.config file. ASP.NET website will use cookies to store session id, even if client doesn't support them. In case that client refuse to save cookie, session data will be lost and new session is created for each request. Thus, clients without cookie support can't use web application.
false - has same meaning as UseCookies.
UseUri - Website will embed session id inside of all relative URLs. ASP.NET Session State will never use cookies, even if client browser supports them. Sessions will work on each client, but could be less secure than session with cookie.
true - same as UseUri.
UseDeviceProfile - ASP.NET will check client if it's capable to support cookies. If client can support cookies, cookie will be used to store session id. Notice that this method just checks browser's features, but it doesn't consider an option that user is manually disabled cookies in browser. If web browser application supports cookies but user is disabled them, session will not work.
AutoDetect - ASP.NET will automatically detect if client supports cookies or not. If client supports cookies, website will use a cookie as storage for session id. If client doesn't support cookies, ASP.NET will embed session id in page URL. This looks as good compromise, although could cause problems with search engines.
Cookieless sessions and RegenerateExpiredSessionId parameter
To enable cookieless session, it is enough to set appropriate value for cookieless parameter. But, sessionState element contains RegenerateExpiredSessionId parameter which is important for security reasons. RegenerateExpiredSessionId could have two values:
True - Expired session ids can't be used again. If visitor comes to website using old session id, it will be replaced with new session id
False - If visitor uses old session id to visit website (e.g. through a bookmark, search engines, social networks etc.), website will create new session collection but session id will stay same.
For security reasons, especially with cookieless sessions, is better to always use RegenerateExpiredSessionId="True". On this way expired session id will not be used for new session, to avoid that different visitors have same session id.

Read its description here
http://msdn.microsoft.com/en-us/library/h6bb9cz9%28VS.71%29.aspx