Obscured URL in ASP.Net Webforms

Question

Hi,

I am working on a ASP.Net web forms application which I inherited from a programmer who has already left the company a few months ago.

The application is deployed in our intranet servers and user go the application via the url:

http://TestApp/App1/(12345abcde)/login.aspx

When I checked the IIS Server, the application's folder is only set to

\inetpub\wwwroot\TestApp\App1\

and from that folder, you could see the login.aspx file.

I'd like to ask what IIS settings did the previous programmer tweaked so that the URL is a bit obscured, where the imaginary(?) folder named (12345abcde) has been inserted. Which settings do I need to check for in the IIS for this?

Another question is that in the login.aspx file, the following can be found: Codebehind="Login.aspx.vb", but the same file Login.aspx.vb is not on the application's directory. Although I did see that there is a bin folder where a dll file resides. Is it possible that the vb code behind file is compiled into that DLL?

By the way, if there is an available dll viewer which I could download, kindly post the same so that I could inspect the DLL in the webforms app.

Appreciate your inputs. Thanks.

Answer 1

This comes from using cookieless sessions in ASP.NET.

Basically, instead of storing the session id in a cookie, it is passed as part of the URL, which makes the app usable even when cookies are disabled in a browser.

To enable/disable this feature, use the following web.config entry:

<sessionState cookieless="true" />

---

Regarding your second question: when you use the "publish web site" function in Visual Studio, all code-behind files are compiled to DLLs (in the bin folder), and the ASPX file are changed to include a reference to the corresponding DLL (in the <@Page > directive).

---

And regarding the "dll viewer": have a look at .NET Reflector.