ASP.NET_SessionId

Larissa Pereira 1

i want to secure 'ASP.NET_SessionId' cookie, so i added

<httpCookies httpOnlyCookies="true" requireSSL="true"/> to web.config and

Response.Cookies[ASP.NET_SessionId].Secure = true; to master page.

However when i add code to master page my session gets lost.
Need help

AgaveJoe 26,141 Reputation points

2021-09-20T12:53:37.95+00:00

The ASP.NET session API is well tested and known to function as expected. Most likely there is a bug in your design or code.

What kind of application are you building? Are you using SSL? Is there any way you can share code that reproduces this issue? Can you explain what "Session gets lost" means and how to reproduce this issue?
Larissa Pereira 1 Reputation point

2021-09-22T06:18:10.707+00:00

I am building a asp.net web application. Yes we are using SSL.

When the session begins, I can see the value in ASP.NET_SessionId cookie, however, when I navigate to another page, this data is lost. Also all the other parameters like user credentials which are saved are lost and the object becomes null.

This happens only when i add Response.Cookies[ASP.NET_SessionId].Secure = true; to my master page or any event in global.asax which is triggered on every request like Application_BeginRequest or Application_EndRequest.

If I add Response.Cookies[ASP.NET_SessionId].Secure = true only in session_start, my attribute sets to true on session start. however if i manually uncheck secure attribute from developer tools in chrome and reload the page, it is not set back to secure. Thus i am trying to set it from global.asax or master page

1 answer

Sam Wu-MSFT 7,036 Reputation points Microsoft Vendor

2021-09-21T03:15:39.787+00:00

Hi @Larissa Pereira

Try to set the Response.Cookies ["ASP.NET_SessionID"].Secure = true in the Session_Start of the global.asax instead of master page.

If the answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Larissa Pereira 1 Reputation point

2021-09-22T07:47:37.463+00:00

@Sam Wu-MSFT by this way i am able to set it at the start of session, however if i manually go to developer tools and uncheck the secure attribute, and i reload the page, it no more sets the cookie as secure. Thus i am trying to do it in master page or any event that gets triggered on every request in global.asax. But when i do it, session is lost.

Sam Wu-MSFT 7,036 Reputation points Microsoft Vendor

2021-09-23T09:28:05.107+00:00

@Larissa Pereira can you tell me why do you go to developer tools and uncheck the secure attribute?
Sign in to comment