0

How to hide the ASP.NET_SessionID cookie string or change the ASP.NET_SessionID name in asp.net webform? TKS!

enter image description here

1 Answer 1

1

You cannot remove this cookie, since it is used by ASP.Net framework internally to identify unique session.

However you can prevent some XSS attacks using HttpOnly

 ASP.NET_SessionId=ig2fac55; path=/; HttpOnly

By default, ASP.Net session cookies are HttpOnly and cannot be modified by client script

MSDN Article

HttpOnly. This property specifies whether the cookie can be accessed by client script. In ASP.NET 2.0, this value is always set to true. Internet Explorer 6 Service Pack 1 supports this cookie attribute, which prevents client-side script from accessing the cookie from the document.cookie property. If an attempt is made to access the cookie from client-side script, an empty string is returned. The cookie is still sent to the server whenever the user browses to a Web site in the current domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.