Session with multiple user

Question

Dear Sir, I refer the following link : https://www.c-sharpcorner.com/uploadfile/61b832/Asp-Net-session-and-web-config-explained/ and i am using the first case in that Now session swapping is not coming. but when i open a popup with google map is not working (Not pointing to the given default location). But after changing its works perfect. I need to use the cookieless="true". can you help me to rectify this? Regards Anoop Krishna

Brajesh Kumar · Answer

Hi Anoop If you set Session to cookieless="true", then ASP.NET must put the Session identifier into your URL, because there is simply no other place it can do it. So when cookieless="false" ASP.NET store Session identifier in dedicated cookie, and when cookieless="true" in URL. ASP.NET offers six different options for cookieless attribute. UseCookies - This is default option, set in machine.config file. ASP.NET website will use cookies to store session id, even if client doesn't support them. In case that client refuse to save cookie, session data will be lost and new session is created for each request. Thus, clients without cookie support can't use web application. false - has same meaning as UseCookies. UseUri - Website will embed session id inside of all relative URLs. ASP.NET Session State will never use cookies, even if client browser supports them. Sessions will work on each client, but could be less secure than session with cookie. true - same as UseUri. UseDeviceProfile - ASP.NET will check client if it's capable to support cookies. If client can support cookies, cookie will be used to store session id. Notice that this method just checks browser's features, but it doesn't consider an option that user is manually disabled cookies in browser. If web browser application supports cookies but user is disabled them, session will not work. AutoDetect - ASP.NET will automatically detect if client supports cookies or not. If client supports cookies, website will use a cookie as storage for session id. If client doesn't support cookies, ASP.NET will embed session id in page URL. This looks as good compromise, although could cause problems with search engines. Cookieless sessions and RegenerateExpiredSessionId parameter To enable cookieless session, it is enough to set appropriate value for cookieless parameter. But, sessionState element contains RegenerateExpiredSessionId parameter which is important for security reasons. RegenerateExpiredSessionId could have two values: True - Expired session ids can't be used again. If visitor comes to website using old session id, it will be replaced with new session id False - If visitor uses old session id to visit website (e.g. through a bookmark, search engines, social networks etc.), website will create new session collection but session id will stay same. For security reasons, especially with cookieless sessions, is better to always use RegenerateExpiredSessionId="True". On this way expired session id will not be used for new session, to avoid that different visitors have same session id. Read its description here http://msdn.microsoft.com/en-us/library/h6bb9cz9%28VS.71%29.aspx

Session with multiple user

Answers (1)