UserA has a PC running IE 6. This has the cookies disabled:
1 - Override automatic cookie handling: checked
2 - First party cookies: Block
3 - Third-party cookies: Block
4 - Always allow session cookies: Unchecked
The server runs a Classic ASP application running in IIS 5.x that uses the
session cache. These are different machines running within a LAN.
When UserA accesses the website, the ASP code retrieves some data from the
DB and puts it into the session cache and timestamps it (to give it a
time-to-live value).
When UserA accesses the site again, the ASP code checks the value of
Session("DatabaseSettings_DateAccessed") to see if the cache has expired.
Bizarrely, it picks up the correct date set on the previous visit.
I would have expected that, since UserA does not have session cookies
enabled, there should be no existing session identifier available for UserA.
So, how is IIS recognising UserA's session?
Thanks in advance
Griff
PS I originally posted this to the IIS group, but got no replies.