Got it...I have just spent the last 3 days cutting my teeth on tmp cookies
and permanent cookies. I followed Aaron's advice and used Browser Hawk...
I am testing for the following condition: Permanent and Session Cookies must
be enabled...otherwise the user must login in every time to see the page.
I think this is a worthwhile sacrifice....here is the Bh starter code for
those interested which incorporates my cookie checks and database inserts
etc:
<%
set bh = Server.CreateObject("cyScape.browserObj")
checkType = 3
if checkType = 3 then
bh.SetExtProperties "cookie_both,referrer"
elseif checkType = 2 then
bh.SetExtProperties "cookie_sess"
elseif checkType = 1 then
bh.SetExtProperties "cookie_perm"
else
response.write "<html>bad checkType specified</html>"
response.end
end if
bh.GetExtPropertiesEx
'--------------------------------------------
'COOKIES= DISABLED/TURNED OFF
'---------------------------------------------
'//response.end
response.write bh.cookies
response.write "<br>"
if not bh.cookies then %>
<p><ul><b>Your browser does not support cookies.</b></ul>
<%
'//FromURL = Bh.Referrer
response.redirect "login.asp?CookieChk=Unsupported" '//&FromURL=" &
FromURL
else
'---------------------------------------------
'COOKIES= TRUE or Logged in WITHOUT cookies = TRUE
'---------------------------------------------
if bh.cookiesEnabled or Request("vID") then '//cookies enabled
u_CurrentURL = Request.ServerVariables("URL")
If u_CurrentURL ="" then
u_CurrentURL ="unknown"
End If
u_VisitorIP = request.ServerVariables("remote_addr")
If u_VisitorIP ="" then
u_VisitorIP ="unknown"
End If
u_Referer = request.ServerVariables("HTTP_REFERER")
If u_Referer ="" then
u_Referer ="unknown"
End If
u_Browser = request.ServerVariables("HTTP_USER_AGENT")
If u_Browser ="" then
u_Browser ="unknown"
End If
'---------------------------------------------
'Check if Cookie there....
'---------------------------------------------
If request.Cookies("Prospect")("u_id") or Request("vID") Then
'
u_id= Request.Cookies("Prospect")("u_id")
u_FromURL=bh.Referrer
If u_FromURL="" then
u_FromURL=Request.servervariables("Remote_Host")
If u_FromURL="" then
u_FromURL="Unknown"
End If
End If
'//Response.end
u_CurrentURL=request.servervariables("URL")
Dim oCmd, oReturn, oConn
set oConn = GetConnection()
'//Set oCmd = GetStoredProcedure(oConn,"sp_adduser1")
If Request("vID") <> "" then
CookieBln=0
'//retrieve user database details as cookies not present
u_id=Request("vID")
u_FromURL=Request("u_FromURL")
u_CurrentURL=Request.servervariables("URL")
'
Set oCmd = GetStoredProcedure(oConn,"sp_GetUser")
oCmd.Parameters.append oCmd.CreateParameter("u_id", adInteger,
adParamInput,10,u_id)
set oRS = oCmd.execute()
if oRS.eof then
Response.Write("You do not appear to be in our database")
else
u_name=escapeString(oRS.fields("u_name"))
response.write u_name
'//response.end
end if
else
CookieBln=1
u_id = Request.Cookies("Prospect")("u_id")
u_name= Request.Cookies("Prospect")("u_name")
'//u_VisitorIP= Request.Cookies("Prospect")("VisitorIP")
End If
Response.write "<p>CookieBln= " & CookieBln & "<p>"
Response.write "u_FromURL: " & u_FromURL & "<br>"
Response.write "u_CurrentURL: " & u_CurrentURL & "<BR>"
Response.write "Prospect expiry date: " & ExpDate & "<br>"
Response.write "Prospect ID: " & u_id & "<br>"
Response.write "Prospect USERNAME: " & u_name & "<br>"
Response.write "Prospect VisitorIP: " & u_VisitorIP & "<br>"
'//response.end
'//INSERT INTO USERPATH
Set oCmd = GetStoredProcedure(oConn,"spr_addUserPath")
oCmd.Parameters.append oCmd.CreateParameter("u_id", adInteger,
adParamInput,4,u_id)
oCmd.Parameters.append oCmd.CreateParameter(" u_name", adVarChar,
adParamInput,70, u_name)
oCmd.Parameters.append oCmd.CreateParameter("UserIP", adVarChar,
adParamInput,20, u_VisitorIP)
oCmd.Parameters.append oCmd.CreateParameter("URLFrom", adVarChar,
adParamInput,100,u_FromURL)
oCmd.Parameters.append oCmd.CreateParameter("URLCurrent", adVarChar,
adParamInput,100,u_CurrentURL)
oCmd.Parameters.append oCmd.CreateParameter("u_browser", adVarChar,
adParamInput,100,u_browser)
oCmd.Parameters.append oCmd.CreateParameter("u_Cookies", adInteger,
adParamInput,4,CookieBln)
'//oCmd.Parameters.append oCmd.CreateParameter("u_OS", adVarChar,
adParamInput,100,u_OS)
'//set oReturn = oCmd.CreateParameter("u_id", adInteger,
adParamOutput)
'//oCmd.Parameters.append oReturn
oCmd.execute()
Else
'---------------------------------------------
'..COOKIE EMPTY
'---------------------------------------------
Response.write "<br><br>CookieID should not be present..<br>"
u_FromURL=bh.Referrer
u_CurrentURL=Request.Servervariables("URL")
response.write u_CurrentURL
'response.end
'If u_FromURL="" then
'u_FromURL="Unknown"
'End IF
'response.write u_FromURL
'response.end
Response.redirect "logon.asp?CookieChk=Deleted&u_FromURL=" &
u_FromURL & "&u_CurrentURL=" & u_CurrentURL
End If
else
'---------------------------------------------
'SUPPORTS COOKIES BUT Disabled
'---------------------------------------------
u_FromURL=bh.Referrer
If u_FromURL="" then
u_FromURL=Request.servervariables("Remote_Host")
If u_FromURL="" then
u_FromURL="Unknown"
End If
End If
If u_CurrentURL="" then
u_CurrentURL=Request.servervariables("URL")
If u_CurrentURL="" then
u_CurrentURL="Unknown"
End If
End If
'response.write u_FromURL
'response.write "<b>Cookies disabled<br>"
'//response.write "logon.asp?CookieChk=Disabled&FromURL=" & u_FromURL
response.redirect "logon.asp?CookieChk=Disabled&u_FromURL=" &
u_FromURL & "&u_CurrentURL=" & u_CurrentURL
'//response.end
end if
End If
%>
"Phillip Windell" <@.> wrote in message
news:et**************@TK2MSFTNGP11.phx.gbl...
...in addition,...sometime when you read about them in some materials they
are called "Temporary Cookies" as opposed to Cookies that are written to
the HD which are considered "permanent". They are kept in the browser's
memory space so if you close the browser they die,..then if you re-open
the browser and go back to the same site it starts a new Session because it
can nolonger find the Session Cookie in memory.
A new Session is still created even if Session Cookies aren't "allowed" by
the user,...it is just that it creates a new Session for every page they
go to because there is no Session Cookie, so it keeps starting a new Session.
--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
<ja***@catamaranco.com> wrote in message
news:%2****************@TK2MSFTNGP10.phx.gbl... I thought if cookies were turned off it meant 'Session cookies' are also
turned off?
- Jason
"Phillip Windell" <@.> wrote in message
news:eZ**************@TK2MSFTNGP12.phx.gbl... "Steven Burn" <pv*@noyb.com> wrote in message
news:Oo*************@tk2msftngp13.phx.gbl...
> > Thanks,Yip, I guessed cookies was the answer....but what about
these curve
> > balls:
> >
> > 1. Cookies off....will the user then be presented with login screen...I am
> > only interested in email - not password.
Session Cookies can be used. They are separate and distinct from the
others and they are not "turned off" when the others are turned off. They
also do not pose the same security risk because they are not written to the drive and are only stored in memory. They are tied to the SessionID and
cannot be used apart from the Session they belong to even if both the server and
the site are still that same server and site.
--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
