Cookie Rewrite & ASPSESSIONID Mk. II

Some background info on the aspsessionid cookie:

 

 

IIS sets a cookie named ASPSESSIONID followed by 20 alpha characters. The 20 characters are dynamically generated based on the process ID of the IIS instance. So as long as the instance is up, the dynamic string will be the same. If the instance is restarted, the PID changes and consequently the dynamic string changes.

 

 

So you can persist off of the cookie name as a whole, or just the dynamic part of the string. There are a few advantages to using this method instead of the cookie value:

 

 

- the cookie name changes less frequently compared with the cookie value

 

- you don't have to worry about the client changing the cookie value

 

- you only have one persistence record per web server--instead of one per client.

 

 

Aaron