How to rewrite SessionID?

by dee 17. January 2008 01:03

The only possibility to make that trick it is to change "ASP.NET_SessionId" cookie before ASP.NET has loaded session state. It can be achieved by handling PostMapRequestHandler application event. For example:

 

void Application_PostMapRequestHandler(object sender, EventArgs e)
{
    string aspNetSessionName = "ASP.NET_SessionId";
    if (Request.Cookies[aspNetSessionName] != null)
    {
        Request.Cookies[aspNetSessionName].Value = "new session ID";
    }
    else
    {
        HttpCookie sessionIDCookie = new HttpCookie(aspNetSessionName, "new session ID");
        Request.Cookies.Add(sessionIDCookie);
    }
}

HttpOnly Cookies

by dee 15. January 2008 02:04

HttpOnly cookies are a Microsoft extension to the cookie standard. The idea is that cookies marked as httpOnly cannot be accessed from JavaScript. This was implemented to stop cookie stealing through XSS vulnerabilities. This is unlike many people believe not a way to stop XSS vulnerabilities, but a way to stop one of the possible attacks (cookie stealing) that are possible through XSS.

ASP.NET uses that feature by default and thus there is no possibility to access to cookies which are marked as httpOnly (for example "ASP.NET_SessionId") in Internet Explorer. To turn it off add following settings to web.config file:

<system.web>
    <httpCookies httpOnlyCookies="false" />
</system.web>

Session object in Session_End event

by dee 3. January 2008 14:59

Trying to use HttpContext.Current.Session in Session_End event of Global.asax will result in NullRefenceException. Use just Session (without HttpContext.Current) object instead.

Powered by BlogEngine.NET 1.4.0.0
Theme by Mads Kristensen