if cookies are disabled, does asp.net store the cookie as a session cookie instead or not?

Question

basically, if cookeis are disabled on the client, im wondering if this...

dim newCookie = New HttpCookie("cookieName", "cookieValue")

newCookie.Expires = DateTime.Now.AddDays(1)

response.cookies.add(newCookie)

notice i set a date, so it should be stored on disk, if cookies are disabled does asp.net automatically store this cookie as a session cookie (which is a cookie that lasts in browser memory until the user closes the browser, if i am not mistaken).... OR does asp.net not add the cookie at all (anywhere) in which case i would have to re-add the cookie to the collection without the date (which stores as a session cookie)... of course, this would require me doing the addition of a cookie twice... perhaps the second time unnecessarily if it is being stored in browsers memory anyway... im just trying not to store it twice as it's just bad code!! any ideas if i need to write another line or not? (which would be)...

response.cookies.add(New HttpCookie("cookieName", "cookieValue") ' session cookie in client browser memory

thanks guys

Answer 1

This MSDN article seems to indicate that there is no built in mechanism for compensating with the user disabling cookies. It also indicates that session state does not work without at least some level of cookies being enabled.

I thought that there was a mechanism for passing a query variable for the session id but skimming the article (quickly) I did not see this.

Hope that helps.

EDIT: It does say that you can use cookieless sessions (I thought you could). They use a separate mechanism to embed session ID in the pages and url links.

Answer 2

To follow up on GrayWizardx's reply, much of what was said is completely accurate.

If you are using a Cookie'd version of Session, and cookies are disabled then you are out of luck. But you have the option to have a cookieless version of the Session, which adds a string to the URL that shows the users session id. This is very ugly looking, and has always concerned me from a security perspective.

So you have three options (that I can think of off the top of my head): 1. Require cookies. This is not a bad thing, especially if your site is one that would have requiring cookies as normal. 2. Use ViewState.
3. Pass information from page to page within the URL. This, again worries me from a security perspective.

Answer 3

You might consider using this little library:

http://www.codeproject.com/KB/aspnet/Univar.aspx

It can automatically switch to the session whenever the cookie is unavailable. It also has a server side implementation of the cookie whereby all cookies are stored on the server and asp.net authentification can be used to identify the user.