aspsessionid name change

asp-classic, asp.net, iis-7, javascript

Solution

There is no option (known or documented - available to the public) to change the name of aspsessionids (classic asp).

You can disable the session (ASP -> Session Properties -> Enable Session State: false) from IIS or by using the @ENABLESESSIONSTATE directive and move on with your own cookies served from asp (and not by JavaScript). But this is OK only if you don't need the session object in your application.

A better approach is to change these "strings" in log files using Regex (asp version is already presented by Anthony W Jones) or by .net (minimal simplified C# sample):

Regex rx = new Regex("ASPSESSIONID[A-Z]+=");

string log = rx.Replace(File.ReadAllText("u_ex120618.log"), "ASPSESSIONID=");
Console.WriteLine(log);

More about aspx and IIS

One option is to use a handler to remove headers.

public class RemoveHttpHeadersModule : IHttpModule
{
    public RemoveHttpHeadersModule()
    {
    }

    public void Dispose()
    {
    }

    public void Init(HttpApplication context)
    {
        if (context != null)
                context.PreSendRequestHeaders += this.OnPreSendRequestHeaders;
    }

    [SuppressMessage("Microsoft.Portability", "CA1903:UseOnlyApiFromTargetedFramework", MessageId = "System.Web.HttpResponse.#get_Headers()")]
    private void OnPreSendRequestHeaders(object sender, EventArgs e)
    {
        try
        {
            HttpContext.Current.Response.Headers.Remove("ETag");
            HttpContext.Current.Response.Headers.Remove("Server");
            HttpContext.Current.Response.Headers.Add("Server", "my server");
        }
        catch (HttpException)
        {
            throw;
        }
    }
}

Another option is to control everything in global.asax (code or compiled library) - covering the case you don't have access to IIS manager.

Remove (and/or add) headers:

protected internal void Application_PreSendRequestHeaders(object sender, EventArgs e)
{
    HttpContext.Current.Response.Headers.Remove("X-AspNet-Version");
    HttpContext.Current.Response.Headers.Remove("X-Powered-By");
    HttpContext.Current.Response.Headers.Remove("ETag");
    HttpContext.Current.Response.Headers.Remove("Server");
}

Handle errors

protected internal void Application_Error(object sender, EventArgs e)
{
    // get the error code            
    int ec = ((HttpException)HttpContext.Current.Error).GetHttpCode();
    // get the request path
    // string req = HttpContext.Current.Request.Path;
    // *** I suggest you to log the error before moving on
    // clear the error to avoid IIS actions
    HttpContext.Current.Server.ClearError();
    if (ec == 404)
    {
        // do what ever you want
    }
    // ... add other error codes handling;
}

The next step is to hide aspx.

Assume that we want our .aspx pages presented as .html This is answered here: What is the proper way to map .html to the ASP.NET pipeline in IIS7

Just take care to select the correct framework version. If you don't have access to IIS manager, then modify your web.config (presenting only what is needed for this task):

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <handlers>
            <add name="htmlpipe" path="*.html" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
        </handlers>
    </system.webServer>
</configuration>

The above setting may differ to your pc, server etc. Having a testing environment with the same basic attributes (framework version, 32/64bit), make the change in your IIS and then check the generated entry in your web.config.

Allow me to make a joke. "Do you like this product?"

Thank you Frank, you made be plug some old disks and find things that were forgotten. I'm sorry for not having suggestions for classic ASP.

PS. Don't forget the answer by HackedByChinese.

Problem

Original source

Related problems

• How to secure classic ASP ASPSESSIONID cookie?
• Classic ASP: Multiple ASPSESSIONID in cookies