How does server recognise new session?

[tty0]

Ayup peeps,

Pure curiosity! but just recently i noticed our server was assigning a new session every time a page was refreshed instead of every time a new user came on the site.

the new user being me (firewalled)

once i changed the firewall settings to trusted it was assigning a new session only when it was supposed to and not every time i refreshed.

Now I know the firewall was set to block cookies but when i set it to trusted top allow cookies it worked ok. So on the surface it looks like a cookie thing.

What i dont understand is the site does not use cookies, instead i have used session variables so there is no cookie passed.... so why does blocking cookies stop the server keeping session? Does it start the session by checking the headers?????

cheers chaps n chapasses 'mi casa es su casa'
]-=tty0=-[
ICQ:82621399

 

[mwolf00]

Your right! asp uses a cookie to store the session id. The cookie only lasts as long as the session. Get the Best Answers! faq333-2924
Is this an asp FAQ? faq333-3048

mikewolf@tst-us.com

 

[Targol]

Session id and variables are stored in form of cookies !!!! Water is not bad as long as it stays out human body ;-)

 

[tty0]

ahhhhhh 8ugger

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnasp/html/aspwsm.asp

for session info.

I had got it into my head that they were not cookie based for some reason, but like you guys say, they are. 'mi casa es su casa'
]-=tty0=-[
ICQ:82621399

 

[Tarwn]

Yep, just to clarify for furture readers, the session id is kept in a cookie on the client browser. The actual session variables are then stored on the server (RAM) and the id assigned to the client is what is used to tie that particular client to a collection of variables in storage. If the user doesn't have a cookie with a session id than the system grants them one, assuming this is there first visit for this session. If the client is blocking cookies, than in effect they will be starting a new session with every page they view because the server can't give them their sessionID.

-Tarwn ________________________________________________________________________________
Sometimes it is how you ask the question: faq333-2924
Many ASP questions have already been answered, please check faq333-3048 and use the search tool before posting

 

[lottastuff]

There used to be an ISAPI called cookie-monster. It will substituted cgi parms where cookies would otherwise be used, parsing outbound HTML adding the session info as a cgi parm (e.g. somepage.asp?sessionid=12345) on the way out and removing it on the way but adding cookie headers as if the user had sent them.

This was popular back when webmaster and sysadmins had response to irrational fears about what a server keeping tabs on it's user might imply. Thank goodness we live in more enlightened times these days