Does an ASP.NET website use cookies by default?

Question

It seems like there are a lot of ways but no default. For State management, does ASP.NET use cookies by default?

• If so, what are the alternatives to using cookies?

• If not, what does ASP.NET use by default to manage state?

Answer 1

Yes - by default, ASP.NET uses cookies to maintain session.

That is, a unique "Session Identifier" cookie is stored on the client to keep track of sessions on the server (state service, sql db, etc).

But in the web.config, you can set cookieless to true:

<sessionState mode="InProc" cookieless="true" timeout="20" />

This will cause that very same "Session Identifier" to be stuck in the URL, and no cookies will be used.

Don't get confused though - the cookies dont store the actual "session". It sounds like you think cookies can be used as an alternative to something like the ASP.NET state service.

When in fact, the cookie just stores an identifer in order to "track" the session, in other words - this "identifier" is passed between the client-server on every HTTP request, this way the server can synchronize a particular session item with the client it belongs to.

Cookie-based/Cookieless session is irrespectible of what actual state storage mechanism you have in place - whether it be In Process session, ASP.NET State Service or SQL Server. It simply dictates the way in which the server is allowed to keep track of sessions.

Of course, cookieless sessions will suit clients that are likely to turn cookies off, but the disadvantage of this is you have ugly URL's, but this can be negated quite easily with the use of URL rewriting, although i would recommend against this - many have reported problems in attempting to do so.

HTH