By default, ASP.NET will set its cookies to use "mydomain.com" as their base. I'd prefer to have them use "www.mydomain.com" instead, so that I can have other "sub.mydomain.com" subdomains that are cookie-free.
I've done some digging into the Session and Cookie objects, and while I can find how to set the domain for a single cookie, I don't see a way to set it for all Session cookies.
Anybody ideas?
Create a ISessionIDManager, since you only want to change the cookie domain we will let the default one do all the work.
This is configured in web.config on the sessionState element under <system.web>.
<sessionState sessionIDManagerType="MySessionIDManager" />
And the implementation.
public class MySessionIDManager: SessionIDManager, ISessionIDManager
{
void ISessionIDManager.SaveSessionID( HttpContext context, string id, out bool redirected, out bool cookieAdded )
{
base.SaveSessionID( context, id, out redirected, out cookieAdded );
if (cookieAdded) {
var name = "ASP.NET_SessionId";
var cookie = context.Response.Cookies[ name ];
cookie.Domain = "example.com";
}
}
}
Session uses only one cookie, so why don't you set domain only for ASP.NET_SessionId cookie ?