Re: Cookieless sessions

[Electronjockey <ele...@ho...>]

Correction/update to this issue:

The access log entry is actually:

"GET /TestApp2/(S(zspamq5blelk00rxi4prldev))/Default.aspx HTTP/1.1" 404

The page that is returned is a asp.net error page:

The resource cannot be found.
Description: HTTP 404. The resource you are looking for (or one of its 
dependencies) could have been removed, had its name changed, or is 
temporarily unavailable.  Please review the following URL and make sure 
that it is spelled correctly.

Requested URL: /TestApp2/Default.aspx

This would seem to suggest that the request is at least reaching the 
asp.net runtime. The System.Web.SessionState.SessionStateModule 
httpModule is added in the web.config.


Electronjockey wrote:
> I was going back through some of the old mailing list threads, and I
> came across :
> http://mail-archives.apache.org/mod_mbox/httpd-cli-users/200412.mbox/%3C6...@po...%3E
>
> I read that Microsoft only added cookieless sessions to asp.net in order
> to support mobile devices that couldn't handle cookies. I also read
> about the obvious security risks that using this method causes.
> Never-the-less, I tried resolving the issue by using a configuration
> like this:
>
>     <Directory "/htdocs/Tests2">
>
>         # Set custom headers
>         <IfModule headers_module>
>            Header set X-Powered-By "ASP.NET"
>         </IfModule>
>
>         Options FollowSymlinks
>         AspNet Files Virtual
>         Order allow,deny
>         Allow from all
>         DirectoryIndex Default.aspx
>
>      </Directory>
>
>      # Attempt to enable cookieless sessionstate
>      # This still doesn't work
>      <Location ~ "^/TestApp2/\(S\(.{24}\)\)/.*">
>         SetHandler asp.net
>         AspNet All
>      </Location>
>
> the \(S\(.{24}\)\) represents the string that is generated for the
> session key by the app. I end up with a 404 in the access log for
> /TestApp2/Default.aspx, which doesn't make much since, as it works when
> I'm using cookies for sessionstate.
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Mod-aspdotnet-users mailing list
> Mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-aspdotnet-users
>
>