How to hide the ASP.NET_SessionID cookie string or change the ASP.NET_SessionID
name in asp.net webform? TKS!
1 Answer
You cannot remove this cookie, since it is used by ASP.Net framework internally to identify unique session.
However you can prevent some XSS attacks using HttpOnly
ASP.NET_SessionId=ig2fac55; path=/; HttpOnly
By default, ASP.Net session cookies are HttpOnly and cannot be modified by client script
HttpOnly. This property specifies whether the cookie can be accessed by client script. In ASP.NET 2.0, this value is always set to true. Internet Explorer 6 Service Pack 1 supports this cookie attribute, which prevents client-side script from accessing the cookie from the document.cookie property. If an attempt is made to access the cookie from client-side script, an empty string is returned. The cookie is still sent to the server whenever the user browses to a Web site in the current domain.