In my ASP .NET web application, when I first navigate to the login page, I do not see a Set-Cookie header coming back in the response from the server. I expect to see one that looks something like:
ASP.NET_SessionId=efypn5ihkam3pdcuucmbykvi; path=/; HttpOnly
Here is my sessionState config entry in the web.config:
<sessionState mode="InProc" cookieless="false" timeout="480"/>
I’ve cleared my cookies in my browser, then navigated to the login page. No Set-Cookie. After I log in to the application, it does send a cookie back for session tracking.
Other apps I’ve built work fine…this one is giving me trouble. Any ideas?
Usually, the session state isn’t started until you create your first session state variable, which usually begins with authentication (after logging in). Unless your deliberately creating a sessionstate variable on the login page request, you shouldn’t see one until you actually log in.