ASP.Net loss of session variables

[leena13]

Hi,

I am facing a problem of loss of session variables once the ASP.Net 2.0 application is deployed. Let me add that this is actually a 1.1 to 2.0 migration.

I found that the first time the page is posted, I found that session variables are getting lost. When I hit Back on IE, and re-enter, the session variables exist and things move smoothly. This problem was not occurring when I tested on my machine, but only after deployment to the server.

I have found that this is because of SSL; on removal of SSL, the session values are retained. But as the application has to be hosted as a secure website, this solution is not acceptable.

So, I tried out a few things, but haven't found any success yet:
1. I commented the existing code of
Response.Cookies ["ASP.NET_SessionID"].Secure = true;
in the global.asax.cs file
2. I tried out the suggestion on http://support.microsoft.com/kb/917412 :

void Session_Start(object sender, EventArgs e)
        {
            if (Response.Cookies.Count > 0)
            {
                foreach (string s in Response.Cookies.AllKeys)
                {
                    if (s == System.Web.Security.FormsAuthentication.FormsCookieName || s.ToLower() == "asp.net_sessionid")
                    {
                        Response.Cookies[s].HttpOnly = false;
                    }
                }
            }
        }

3. I also tried setting to privacy setting to Low on the internet options as well as checking the Allow Session cookies option.

Is there anything that I am missing? I have spent a lot of time on this...any suggestions?

[sani723]

this may helps u,

http://aspalliance.com/1182_Troubles...sues_in_ASPNET

Or

http://support.microsoft.com/default...3&GSA_AC_More3

[kenobewan]

Welcome to the site. Did you see this article:
SSL Termination and ASP.NET

Especially the bit about having to set the secure attribute on the FormsAuthentication cookie:

Response.Cookies[s].Secure = true;

[leena13]

Thanks kenobewan and Sani723 for your posts.

We are actually using Windows Authentication, not forms authentication.

I'll try to make the picture clearer by adding a few things to my earlier post:
Any authenticated user gets to see the login page, others are re-directed to an error page. When this authenticated user clicks on this page, an error occurs which is because of loss of session variables. Click back on ie, and re-post, the user can then enter the application.

On the IIS, I'm selecting SSL. In fact,
the code

Response.Cookies[s].secure = true 

is redundant.

[Plater]

You are remembering that when you deploy an application all session states and varriables are lost becaise it deploys as "shutdown" and won't "startup" until a call is made to it. So if you are sitting on this "i am windowsauthenticated so i can see the login page" and then you re-deploy your project (or for whatever reason it is shut down already, possibly do to idle time) then your session state will be gone and the server has no knowledge that you are authenticated so when you click, your credentials aren't there. And it will error out.

Not sure if thats your problem, but a lot of people's questions here are because they simply were not aware that the session values get wiped out when deploying.