Session object and coockies in asp.net

[RA]

Hi

Please review and let me know if I am correct:

1) My understanding from reading
http://msdn.microsoft.com/library/de...us/dnpag/html/
diforwc-ch05.asp is that asp.net uses cookies to store the user session id,
but if cookies are not enabled then it will send the session id as part of
the url. Is this correct?

2) I also understand from the article that all the information I use with
the session object such as Session["UserName"]=txtUserName.Text... is kept
on the server. If the web.config session state mode="inproc" then the
session object information will be stored and managed by Aspnet_wp.exe
process. So in this case the Session["UserName"] will always have a valid
data regardless if the user enables cookies or not. Am I correct?

This all lead me to a conclusion that if I use the Session object to store
user information, then I should be safe reading and storing the information
weather the user enables cookies or not.
Thanks

[Z D]

The issue is tracking the user's session. If they have cookies disabled then
you wont know which user relates to which session on the server (and thus
the server wont know which Session["UserName"] to use).

Note: The session ID is only stored in the URL if you explicitly tell it to
do so in web.config

-ZD
"RA" <ro****@hotmail.com> wrote in message
news:uS**************@TK2MSFTNGP12.phx.gbl...

Hi

Please review and let me know if I am correct:

1) My understanding from reading
http://msdn.microsoft.com/library/de...us/dnpag/html/ diforwc-ch05.asp is that asp.net uses cookies to store the user session id, but if cookies are not enabled then it will send the session id as part of
the url. Is this correct?

2) I also understand from the article that all the information I use with
the session object such as Session["UserName"]=txtUserName.Text... is kept
on the server. If the web.config session state mode="inproc" then the
session object information will be stored and managed by Aspnet_wp.exe
process. So in this case the Session["UserName"] will always have a valid
data regardless if the user enables cookies or not. Am I correct?

This all lead me to a conclusion that if I use the Session object to store
user information, then I should be safe reading and storing the information weather the user enables cookies or not.
Thanks

[RA]

This is not what being said in the microsoft document.
Look in the document and you will see that it is applied to the url if the
cookies disabled at the browser.

"Z D" <NO****@NOSPAM.com> wrote in message
news:eS**************@TK2MSFTNGP09.phx.gbl...

The issue is tracking the user's session. If they have cookies disabled then you wont know which user relates to which session on the server (and thus
the server wont know which Session["UserName"] to use).

Note: The session ID is only stored in the URL if you explicitly tell it to do so in web.config

-ZD
"RA" <ro****@hotmail.com> wrote in message
news:uS**************@TK2MSFTNGP12.phx.gbl...

Hi

Please review and let me know if I am correct:

1) My understanding from reading

http://msdn.microsoft.com/library/de...us/dnpag/html/

diforwc-ch05.asp is that asp.net uses cookies to store the user session

id,

but if cookies are not enabled then it will send the session id as part of the url. Is this correct?

2) I also understand from the article that all the information I use with the session object such as Session["UserName"]=txtUserName.Text... is kept on the server. If the web.config session state mode="inproc" then the
session object information will be stored and managed by Aspnet_wp.exe
process. So in this case the Session["UserName"] will always have a valid data regardless if the user enables cookies or not. Am I correct?

This all lead me to a conclusion that if I use the Session object to store user information, then I should be safe reading and storing the

information

weather the user enables cookies or not.
Thanks

[Z D]

What microsoft document?

You have to allow it in web.config or else it doesnt work.
"RA" <ro****@hotmail.com> wrote in message
news:eX**************@tk2msftngp13.phx.gbl...

This is not what being said in the microsoft document.
Look in the document and you will see that it is applied to the url if the
cookies disabled at the browser.

"Z D" <NO****@NOSPAM.com> wrote in message
news:eS**************@TK2MSFTNGP09.phx.gbl...

The issue is tracking the user's session. If they have cookies disabled then

you wont know which user relates to which session on the server (and thus

the server wont know which Session["UserName"] to use).

Note: The session ID is only stored in the URL if you explicitly tell it

to

do so in web.config

-ZD
"RA" <ro****@hotmail.com> wrote in message
news:uS**************@TK2MSFTNGP12.phx.gbl...

Hi

Please review and let me know if I am correct:

1) My understanding from reading

http://msdn.microsoft.com/library/de...us/dnpag/html/

diforwc-ch05.asp is that asp.net uses cookies to store the user

session

id,

but if cookies are not enabled then it will send the session id as

part of the url. Is this correct?

2) I also understand from the article that all the information I use with the session object such as Session["UserName"]=txtUserName.Text... is kept on the server. If the web.config session state mode="inproc" then the
session object information will be stored and managed by Aspnet_wp.exe
process. So in this case the Session["UserName"] will always have a valid data regardless if the user enables cookies or not. Am I correct?

This all lead me to a conclusion that if I use the Session object to store user information, then I should be safe reading and storing the

information

weather the user enables cookies or not.
Thanks

[RA]

Look at :
http://msdn.microsoft.com/library/de...us/dnpag/html/
"Z D" <NO****@NOSPAM.com> wrote in message
news:#1**************@tk2msftngp13.phx.gbl...

What microsoft document?

You have to allow it in web.config or else it doesnt work.
"RA" <ro****@hotmail.com> wrote in message
news:eX**************@tk2msftngp13.phx.gbl...

This is not what being said in the microsoft document.
Look in the document and you will see that it is applied to the url if the

cookies disabled at the browser.

"Z D" <NO****@NOSPAM.com> wrote in message
news:eS**************@TK2MSFTNGP09.phx.gbl...

The issue is tracking the user's session. If they have cookies disabled

then

you wont know which user relates to which session on the server (and thus the server wont know which Session["UserName"] to use).

Note: The session ID is only stored in the URL if you explicitly tell

it to

do so in web.config

-ZD
"RA" <ro****@hotmail.com> wrote in message
news:uS**************@TK2MSFTNGP12.phx.gbl...
> Hi
>
> Please review and let me know if I am correct:
>
> 1) My understanding from reading
>

http://msdn.microsoft.com/library/de...us/dnpag/html/ > diforwc-ch05.asp is that asp.net uses cookies to store the user session id,
> but if cookies are not enabled then it will send the session id as

part

of

> the url. Is this correct?
>
> 2) I also understand from the article that all the information I use

with

> the session object such as Session["UserName"]=txtUserName.Text... is kept

> on the server. If the web.config session state mode="inproc" then

the > session object information will be stored and managed by Aspnet_wp.exe > process. So in this case the Session["UserName"] will always have a

valid

> data regardless if the user enables cookies or not. Am I correct?
>
> This all lead me to a conclusion that if I use the Session object to

store

> user information, then I should be safe reading and storing the
information
> weather the user enables cookies or not.
>
>
> Thanks
>
>
>

[Z D]

that link doesn't work... you didnt link the file name of the document...
"RA" <ro****@hotmail.com> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl...

Look at :
http://msdn.microsoft.com/library/de...us/dnpag/html/

"Z D" <NO****@NOSPAM.com> wrote in message
news:#1**************@tk2msftngp13.phx.gbl...

What microsoft document?

You have to allow it in web.config or else it doesnt work.
"RA" <ro****@hotmail.com> wrote in message
news:eX**************@tk2msftngp13.phx.gbl...

This is not what being said in the microsoft document.
Look in the document and you will see that it is applied to the url if the cookies disabled at the browser.

"Z D" <NO****@NOSPAM.com> wrote in message
news:eS**************@TK2MSFTNGP09.phx.gbl...
> The issue is tracking the user's session. If they have cookies disabled then
> you wont know which user relates to which session on the server (and thus

> the server wont know which Session["UserName"] to use).
>
> Note: The session ID is only stored in the URL if you explicitly tell it

to
> do so in web.config
>
> -ZD
>
>
> "RA" <ro****@hotmail.com> wrote in message
> news:uS**************@TK2MSFTNGP12.phx.gbl...
> > Hi
> >
> > Please review and let me know if I am correct:
> >
> > 1) My understanding from reading
> >
>

http://msdn.microsoft.com/library/de...us/dnpag/html/ > > diforwc-ch05.asp is that asp.net uses cookies to store the user

session

> id,
> > but if cookies are not enabled then it will send the session id as

part

of
> > the url. Is this correct?
> >
> > 2) I also understand from the article that all the information I use with
> > the session object such as Session["UserName"]=txtUserName.Text... is kept
> > on the server. If the web.config session state mode="inproc" then the > > session object information will be stored and managed by Aspnet_wp.exe > > process. So in this case the Session["UserName"] will always have a valid
> > data regardless if the user enables cookies or not. Am I correct?
> >
> > This all lead me to a conclusion that if I use the Session object to store
> > user information, then I should be safe reading and storing the
> information
> > weather the user enables cookies or not.
> >
> >
> > Thanks
> >
> >
> >
>
>

[RA]

Sorry,
http://msdn.microsoft.com/library/de...us/dnpag/html/
diforwc-ch05.asp

"Z D" <NO****@NOSPAM.com> wrote in message
news:eF**************@TK2MSFTNGP12.phx.gbl...

that link doesn't work... you didnt link the file name of the document...
"RA" <ro****@hotmail.com> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl...

Look at :

http://msdn.microsoft.com/library/de...us/dnpag/html/

"Z D" <NO****@NOSPAM.com> wrote in message
news:#1**************@tk2msftngp13.phx.gbl...

What microsoft document?

You have to allow it in web.config or else it doesnt work.
"RA" <ro****@hotmail.com> wrote in message
news:eX**************@tk2msftngp13.phx.gbl...
> This is not what being said in the microsoft document.
> Look in the document and you will see that it is applied to the url if

the

> cookies disabled at the browser.
>
>
>
> "Z D" <NO****@NOSPAM.com> wrote in message
> news:eS**************@TK2MSFTNGP09.phx.gbl...
> > The issue is tracking the user's session. If they have cookies

disabled

> then
> > you wont know which user relates to which session on the server

(and thus
> > the server wont know which Session["UserName"] to use).
> >
> > Note: The session ID is only stored in the URL if you explicitly tell

it

> to
> > do so in web.config
> >
> > -ZD
> >
> >
> > "RA" <ro****@hotmail.com> wrote in message
> > news:uS**************@TK2MSFTNGP12.phx.gbl...
> > > Hi
> > >
> > > Please review and let me know if I am correct:
> > >
> > > 1) My understanding from reading
> > >
> >
>

http://msdn.microsoft.com/library/de...us/dnpag/html/

> > > diforwc-ch05.asp is that asp.net uses cookies to store the user
session
> > id,
> > > but if cookies are not enabled then it will send the session id as part
> of
> > > the url. Is this correct?
> > >
> > > 2) I also understand from the article that all the information I use > with
> > > the session object such as Session["UserName"]=txtUserName.Text... is

> kept
> > > on the server. If the web.config session state mode="inproc"

then

the

> > > session object information will be stored and managed by

Aspnet_wp.exe

> > > process. So in this case the Session["UserName"] will always

have a > valid
> > > data regardless if the user enables cookies or not. Am I

correct? > > >
> > > This all lead me to a conclusion that if I use the Session

object to > store
> > > user information, then I should be safe reading and storing the
> > information
> > > weather the user enables cookies or not.
> > >
> > >
> > > Thanks
> > >
> > >
> > >
> >
> >
>
>

[Z D]

You are prolly referring to this quote from that article:
"If the client or application is configured to disallow cookies, ASP.NET
encodes the session ID as part of the URL the client uses when making
requests to the application"

It is a little ambigious and not technically 100% correct. The incorrect
part is "client or application".

If the client is configured to disallow cookies, then asp.net does NOT
autmatically put the sessionID in the URL.

It ONLY puts the sessionID in the url if the Applicaion is configured to
disallow cookies. (ie you set cookieless = true in web.config)

try it yourself and you will see that i'm correct.
"RA" <ro****@hotmail.com> wrote in message
news:%2****************@TK2MSFTNGP09.phx.gbl...

Sorry,
http://msdn.microsoft.com/library/de...us/dnpag/html/ diforwc-ch05.asp

"Z D" <NO****@NOSPAM.com> wrote in message
news:eF**************@TK2MSFTNGP12.phx.gbl...

that link doesn't work... you didnt link the file name of the document...

"RA" <ro****@hotmail.com> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl...

Look at :

http://msdn.microsoft.com/library/de...us/dnpag/html/

"Z D" <NO****@NOSPAM.com> wrote in message
news:#1**************@tk2msftngp13.phx.gbl...
> What microsoft document?
>
> You have to allow it in web.config or else it doesnt work.
>
>
> "RA" <ro****@hotmail.com> wrote in message
> news:eX**************@tk2msftngp13.phx.gbl...
> > This is not what being said in the microsoft document.
> > Look in the document and you will see that it is applied to the url if

the
> > cookies disabled at the browser.
> >
> >
> >
> > "Z D" <NO****@NOSPAM.com> wrote in message
> > news:eS**************@TK2MSFTNGP09.phx.gbl...
> > > The issue is tracking the user's session. If they have cookies
disabled
> > then
> > > you wont know which user relates to which session on the server (and > thus
> > > the server wont know which Session["UserName"] to use).
> > >
> > > Note: The session ID is only stored in the URL if you explicitly tell

it
> > to
> > > do so in web.config
> > >
> > > -ZD
> > >
> > >
> > > "RA" <ro****@hotmail.com> wrote in message
> > > news:uS**************@TK2MSFTNGP12.phx.gbl...
> > > > Hi
> > > >
> > > > Please review and let me know if I am correct:
> > > >
> > > > 1) My understanding from reading
> > > >
> > >
> >
>

http://msdn.microsoft.com/library/de...us/dnpag/html/ > > > > diforwc-ch05.asp is that asp.net uses cookies to store the user > session
> > > id,
> > > > but if cookies are not enabled then it will send the session id as

> part
> > of
> > > > the url. Is this correct?
> > > >
> > > > 2) I also understand from the article that all the information

I

use

> > with
> > > > the session object such as

Session["UserName"]=txtUserName.Text... is
> > kept
> > > > on the server. If the web.config session state mode="inproc" then the
> > > > session object information will be stored and managed by
Aspnet_wp.exe
> > > > process. So in this case the Session["UserName"] will always have

a

> > valid
> > > > data regardless if the user enables cookies or not. Am I

correct? > > > >
> > > > This all lead me to a conclusion that if I use the Session

object

to

> > store
> > > > user information, then I should be safe reading and storing

the > > > information
> > > > weather the user enables cookies or not.
> > > >
> > > >
> > > > Thanks
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

[RA]

Thank you,

So if I use cookieless = true then asp.net will use the url for session id
and I can be safe using the session information I am saving. Am I correct?

"Z D" <NO****@NOSPAM.com> wrote in message
news:#c**************@TK2MSFTNGP12.phx.gbl...

You are prolly referring to this quote from that article:
"If the client or application is configured to disallow cookies, ASP.NET
encodes the session ID as part of the URL the client uses when making
requests to the application"

It is a little ambigious and not technically 100% correct. The incorrect
part is "client or application".

If the client is configured to disallow cookies, then asp.net does NOT
autmatically put the sessionID in the URL.

It ONLY puts the sessionID in the url if the Applicaion is configured to
disallow cookies. (ie you set cookieless = true in web.config)

try it yourself and you will see that i'm correct.
"RA" <ro****@hotmail.com> wrote in message
news:%2****************@TK2MSFTNGP09.phx.gbl...

Sorry,

http://msdn.microsoft.com/library/de...us/dnpag/html/

diforwc-ch05.asp

"Z D" <NO****@NOSPAM.com> wrote in message
news:eF**************@TK2MSFTNGP12.phx.gbl...

that link doesn't work... you didnt link the file name of the document...

"RA" <ro****@hotmail.com> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl...
> Look at :
>

http://msdn.microsoft.com/library/de...us/dnpag/html/

>
>
> "Z D" <NO****@NOSPAM.com> wrote in message
> news:#1**************@tk2msftngp13.phx.gbl...
> > What microsoft document?
> >
> > You have to allow it in web.config or else it doesnt work.
> >
> >
> > "RA" <ro****@hotmail.com> wrote in message
> > news:eX**************@tk2msftngp13.phx.gbl...
> > > This is not what being said in the microsoft document.
> > > Look in the document and you will see that it is applied to the url

if

> the
> > > cookies disabled at the browser.
> > >
> > >
> > >
> > > "Z D" <NO****@NOSPAM.com> wrote in message
> > > news:eS**************@TK2MSFTNGP09.phx.gbl...
> > > > The issue is tracking the user's session. If they have cookies
> disabled
> > > then
> > > > you wont know which user relates to which session on the server

(and

> > thus
> > > > the server wont know which Session["UserName"] to use).
> > > >
> > > > Note: The session ID is only stored in the URL if you

explicitly tell
> it
> > > to
> > > > do so in web.config
> > > >
> > > > -ZD
> > > >
> > > >
> > > > "RA" <ro****@hotmail.com> wrote in message
> > > > news:uS**************@TK2MSFTNGP12.phx.gbl...
> > > > > Hi
> > > > >
> > > > > Please review and let me know if I am correct:
> > > > >
> > > > > 1) My understanding from reading
> > > > >
> > > >
> > >
> >
>

http://msdn.microsoft.com/library/de...us/dnpag/html/

> > > > > diforwc-ch05.asp is that asp.net uses cookies to store the user > > session
> > > > id,
> > > > > but if cookies are not enabled then it will send the session id

as

> > part
> > > of
> > > > > the url. Is this correct?
> > > > >
> > > > > 2) I also understand from the article that all the

information I use
> > > with
> > > > > the session object such as

Session["UserName"]=txtUserName.Text...

> is
> > > kept
> > > > > on the server. If the web.config session state mode="inproc"

then

> the
> > > > > session object information will be stored and managed by
> Aspnet_wp.exe
> > > > > process. So in this case the Session["UserName"] will always

have

a
> > > valid
> > > > > data regardless if the user enables cookies or not. Am I

correct?

> > > > >
> > > > > This all lead me to a conclusion that if I use the Session

object

to
> > > store
> > > > > user information, then I should be safe reading and storing the > > > > information
> > > > > weather the user enables cookies or not.
> > > > >
> > > > >
> > > > > Thanks
> > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

[Z D]

if you put cookiless=true then you must be careful to ONLY use relative
paths when linking to other pages, images, etc within your app. If you use
absolute paths it will not work correctly.

"RA" <ro****@hotmail.com> wrote in message
news:eO**************@tk2msftngp13.phx.gbl...

Thank you,

So if I use cookieless = true then asp.net will use the url for session id and I can be safe using the session information I am saving. Am I correct?

"Z D" <NO****@NOSPAM.com> wrote in message
news:#c**************@TK2MSFTNGP12.phx.gbl...

You are prolly referring to this quote from that article:
"If the client or application is configured to disallow cookies, ASP.NET
encodes the session ID as part of the URL the client uses when making
requests to the application"

It is a little ambigious and not technically 100% correct. The incorrect

part is "client or application".

If the client is configured to disallow cookies, then asp.net does NOT
autmatically put the sessionID in the URL.

It ONLY puts the sessionID in the url if the Applicaion is configured to
disallow cookies. (ie you set cookieless = true in web.config)

try it yourself and you will see that i'm correct.
"RA" <ro****@hotmail.com> wrote in message
news:%2****************@TK2MSFTNGP09.phx.gbl...

Sorry,

http://msdn.microsoft.com/library/de...us/dnpag/html/

diforwc-ch05.asp

"Z D" <NO****@NOSPAM.com> wrote in message
news:eF**************@TK2MSFTNGP12.phx.gbl...
> that link doesn't work... you didnt link the file name of the

document...

>
>
> "RA" <ro****@hotmail.com> wrote in message
> news:%2****************@TK2MSFTNGP11.phx.gbl...
> > Look at :
> >
>

http://msdn.microsoft.com/library/de...us/dnpag/html/

> >
> >
> > "Z D" <NO****@NOSPAM.com> wrote in message
> > news:#1**************@tk2msftngp13.phx.gbl...
> > > What microsoft document?
> > >
> > > You have to allow it in web.config or else it doesnt work.
> > >
> > >
> > > "RA" <ro****@hotmail.com> wrote in message
> > > news:eX**************@tk2msftngp13.phx.gbl...
> > > > This is not what being said in the microsoft document.
> > > > Look in the document and you will see that it is applied to the

url

if
> > the
> > > > cookies disabled at the browser.
> > > >
> > > >
> > > >
> > > > "Z D" <NO****@NOSPAM.com> wrote in message
> > > > news:eS**************@TK2MSFTNGP09.phx.gbl...
> > > > > The issue is tracking the user's session. If they have

cookies > > disabled
> > > > then
> > > > > you wont know which user relates to which session on the server (and
> > > thus
> > > > > the server wont know which Session["UserName"] to use).
> > > > >
> > > > > Note: The session ID is only stored in the URL if you explicitly > tell
> > it
> > > > to
> > > > > do so in web.config
> > > > >
> > > > > -ZD
> > > > >
> > > > >
> > > > > "RA" <ro****@hotmail.com> wrote in message
> > > > > news:uS**************@TK2MSFTNGP12.phx.gbl...
> > > > > > Hi
> > > > > >
> > > > > > Please review and let me know if I am correct:
> > > > > >
> > > > > > 1) My understanding from reading
> > > > > >
> > > > >
> > > >
> > >
> >
>

http://msdn.microsoft.com/library/de...us/dnpag/html/

> > > > > > diforwc-ch05.asp is that asp.net uses cookies to store the

user

> > > session
> > > > > id,
> > > > > > but if cookies are not enabled then it will send the session id

as
> > > part
> > > > of
> > > > > > the url. Is this correct?
> > > > > >
> > > > > > 2) I also understand from the article that all the information

I

> use
> > > > with
> > > > > > the session object such as
Session["UserName"]=txtUserName.Text...
> > is
> > > > kept
> > > > > > on the server. If the web.config session state

mode="inproc" then
> > the
> > > > > > session object information will be stored and managed by
> > Aspnet_wp.exe
> > > > > > process. So in this case the Session["UserName"] will always have
> a
> > > > valid
> > > > > > data regardless if the user enables cookies or not. Am I
correct?
> > > > > >
> > > > > > This all lead me to a conclusion that if I use the Session
object
> to
> > > > store
> > > > > > user information, then I should be safe reading and

storing the

> > > > > information
> > > > > > weather the user enables cookies or not.
> > > > > >
> > > > > >
> > > > > > Thanks
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>