Geek Answers Handbook

Separate applications sharing the same ASP.Net Session Cookie application

I have two ASP.Net applications that are located on two different folders on my server:

  • /Foo <is a standard insecure application
  • /Secure <is a standalone application that requires SSL over IIS

The problem is that by default, the ASP.NET_SessionId cookie ASP.NET_SessionId specified in the domain and is shared between two applications in different directories. I need the session cookie to be different, because I cannot allow the captured cookie on /Foo to access the /Secure application.

Ideally, I would like each application cookie to be limited by the cookie Path property. There seems to be no way to do this in .Net out of the box.

As an added headache, even if I write special code to set the path to the cookie, I'm afraid that some browsers are case sensitive and will not use the same cookie for /Foo and /Foo , which, depending on which how links are built can lead to multiple sessions in one application.

Has anyone encountered and overcome this problem?

+6
ssl cookies session
source share
4 answers

In .Net 2.0 and later, you can set the cookieName attribute of the sessionState XML element in your web.config for different values ​​for each of your applications. This will prevent them from using the same session identifier.

Here is the MSDN link for this.

+9
source share

if you use forms authentication, you also need to change the forms cookie in the web.config file:

 <forms name="Foo"... <forms name="Secure"...
+1
source share

It looks like they are only in separate virtual directories, but are still in the same application pool. If you really want the applications to be separate, try creating another application pool for your / secure application.

0
source share

Check the icon in the /Secure folder in IIS.

If it has a cog icon, then this is a separate application, and the sessions should be different, and the application will be launched in it by its own appdomain.

If it is a globe icon, then it is a virtual directory and will share the same session as the root site and /Foo .

0
source share

More articles:


All Articles