hiding session ID in browser

[Vlad Jasovic]

hello,

I have following session setting in my web.config file:
<configuration>
<system.web>
<sessionState
mode = "InProc"
cookieless="true"
timeout="10"/>
</system.web>
</configuration>

However, when I open my browser I get this in address bar:
http://192.168.0.110/blabla/(uzqltc45cdkwhb25h5oxpgfn)/faq.aspx

Is there any way I can hide this (sessionID).


Thanks,

 

[Raterus]

You are using cookieless sessionstate, so the sessionID has to appear in the address bar.
--Michael.

 

[Vlad Jasovic]

Sorry, forgot to mention that I want to have cookieless="true".

Is there any way I can hide sessiodID with these setting on "true"

 

[Raterus]

yeah, it really only affects obsessive-compulsive security-o-holics who raise the security of their browsers to block all cookies, People who do that run into quite a few problems in their web-browsing experience, so it serves them right if it doesn't work for them.

use the cookie, they taste good too.

 

[Vlad Jasovic]

The reason why I want to do this without cookies is because this web-site is
for broad audience and some of them (you'd be surprised) do have cookies
disabled.

Problem why I don't want SessionID in browser is because when you add
web-site to favorites it stores SessionID too. Doing some shopping carts and
wouldn't like to see it.




yeah, it really only affects obsessive-compulsive security-o-holics who
raise the security of their browsers to block all cookies, People who do
that run into quite a few problems in their web-browsing experience, so it
serves them right if it doesn't work for them.

use the cookie, they taste good too.

 

[Mark Rae]

The reason why I want to do this without cookies is because this web-site is
for broad audience and some of them (you'd be surprised) do have cookies
disabled.

It's not unreasonable to inform users that, if they want to use your site,
they will have to enable cookies on their browser...

Problem why I don't want SessionID in browser is because when you add
web-site to favorites it stores SessionID too. Doing some shopping carts and
wouldn't like to see it.

Then, regrettably, a web solution will not meet your needs, at least, not an
ASP.NET / IIS one...

 

[Marina]

In this case I would recommend not relying on session, but rolling your own
solution. Store an ID in viewstate or something on every page, be sure to
pass it along from page to page. Store your data somehow indexed by this ID,
so that then you can get it any time.

I agree that it is not unreasonable to require your site to only function
properly with cookies enabled. Either that, or give up the ability to
bookmark on favorites. People can't have their cake and eat it too. They
can't go nuts with security and turn everything off - and then expect the
same level of functionality.