Separate Applications Sharing the Same ASP.Net Session Cookie

Question

I've got two ASP.Net applications residing in two different folders on my server:

• /Foo <-- this is the standard unsecure application
• /Secure <-- this is a separate application that requires SSL by IIS

The problem is that by default, the ASP.NET_SessionId cookie is specified on the domain and is shared between the two applications in different directories. I need the session cookie to be different because I can't allow a hijacked cookie on /Foo to be used to grant access to the /Secure application.

Ideally, I would like each application's cookie to be limited by the cookie Path property. There's apparently no way to do this in .Net out of the box.

As an added headache, even if I write custom code to set the cookie path, I'm fearful that some browsers are case sensitive and won't use the same session cookie for /Foo and /foo, which, depending on how the links are built, can result in multiple sessions in the same application.

Has anyone encountered and overcome this issue?

Answer 1

Sounds like they are just in separate virtual directories, but are still in the same Application Pool. If you really want the applications to be separate, try creating another application pool for your /secure app.

Answer 2

To clarify ... do you have two different "web sites" in IIS, or two different folders under a single "web site" in IIS?

Answer 3

The applications are both in separate application pools. That has no bearing on the fact that .Net will "reuse" a cookie that it hasn't had before.

There is a single website in IIS, with one folder for /Foo and a virtual directory for /Secure.

Answer 4

Check the icon for your /Secure folder in IIS.

If it has a cog icon then it's a seperate application and the sessions should be different and the app will run in it's own appdomain.

If it's a globe icon then it's a virtual directory and will share the same session as the root site and /Foo.

HTH
Kev

Answer 5

In .Net 2.0 and above, you can set the "cookieName" attribute of the "sessionState" XML element in your web.config to different values for each of your applications. That will keep them from using the same session ID.

Here's the MSDN reference for this.

Answer 6

David, you rock! I had no idea that setting existed! Thanks a ton!