CookiesLess session in ASP.NET

introduction:

As developers, we know that sessions and cookies are used as part of state management techniques in Asp.NET applications. In the case of cookies, a session ID is placed in the cookie and validated every time a request reaches the server for execution. Of course, this makes the URLs clean and navigation very easy to understand. However, there is one interesting scenario, which many of us may have used. Cookie-less sessions.

Traditionally, session IDs are stored in cookies. However, for cookieless sessions, the session ID is embedded directly in the URL, allowing session tracking even when cookies are disabled.

How Cookieless Sessions Work

When using cookieless sessions, ASP.NET modifies the URL by adding the session ID. For example, the URL would look like this: http://stackoverflowwebapp.com/(S(klnc3sshuaf3ngm3ihnpch2v))/home.aspx.

The session ID is embedded between the application name and the file path. This ensures that the session state is maintained as long as the user follows the link provided by your application.

Let’s take a look at how it’s done.

To enable cookieless sessions, you must set the cookieless attribute to true in the sessionState element in the Web.config file.

I regenerated this and could see that the session ID was stuck between my domain and the page with the (S). When the session ID was adjusted, the same session ID was regenerated.

Looking at this, many users might be confused because the URL is not familiar. But it works. So we can implement CookieLess Session in our application.

It was easy to set up, right? But there were some compromises involved.

Security Considerations

Cookieless sessions have certain security concerns. Since the session ID is part of the URL, it can be accidentally shared if you copy the URL and share it with someone else. This causes Session hijacking. To mitigate this risk, we recommend that you consider using and configuring SSL to encrypt communications between clients and servers. Regenerate expired session ID Set to true to prevent session reuse.

So, considering the above, CookieLess sessions should be implemented in very specific scenarios, not always. See the official documentation for this.

https://learn.microsoft.com/en-us/dotnet/api/system.web.sessionstate.httpsessionstate.iscookieless?v…