Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>When you start a new browser session and browse to your site, classic ASP will detect that there is no ASP session cookie and will create a new session for you (as you have already experienced).</p> <p>Session cookies are just that, they exist for the lifetime of the session. When you close your browser the session cookie will be deleted (even though your session state on the server will live on as an orphaned session until Session.Timeout expires - unless you present the same session cookie again within the Session.Timeout period). </p> <p>The only way to extend the lifetime of the ASP session cookie across new browser sessions/instances would be to alter the cookie lifetime using script on the browser/client.</p> <p>If you're looking to manage state across events such as the browser closing, you'll need implement your own state management mechanism (persist state to a database for example) and use a regular cookie with a long lifetime (or with a sliding expiration where you extend the lifetime by a small amount of time on each request in your server side script) to match state to the user.</p> <p><strong>Edit:</strong></p> <p>The following article has a script to modify the session cookie (scroll down to Cookie Expiration):</p> <ul> <li><a href="https://web.archive.org/web/20070504042700/http://palisade.plynt.com/issues/2007Feb/asp-session-cookies/" rel="nofollow noreferrer">ASP Session Cookies (Plynt)</a>, via archive.org</li> </ul> <p>But as Shoban correctly points out there is a risk of <a href="http://www.owasp.org/index.php/Session_Fixation" rel="nofollow noreferrer">Session Fixation (OWASP)</a>. You can however go some way to protect yourself against this:</p> <ul> <li><a href="http://www.owasp.org/index.php/Session_Fixation_Protection" rel="nofollow noreferrer">Session Fixation Protection (OWASP)</a></li> </ul> <p>I'd also add some caveats, if your application is storing sensitive data (credit cards, financials, medical etc) then I'd suggest not doing this and live with the fact that your user will have to logon again and start a new session. Better safe than sorry.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload