search

aspnet / AspNetKatana

Microsoft's OWIN implementation, the Katana project
Apache License 2.0
963 stars 332 forks source link

Q: Missing ASP.NET_SessionId cookie (again?) #390

Closed Peperud closed 3 years ago

Peperud commented 3 years ago

We fought that (or similar) issue few years back by adding something to the session early in the login flow. Then when this became available switched to use SystemWebCookieManager. Two places - cookie auth and IdentityServer auth. The one in the cookie auth is straight SystemWebCookieManager and the one in IdentityServer auth is customized to handle SameSite as outlined here and the backing inner cookie manager is SystemWebCookieManager.

Analyzing logs (for what might be an unrelated issue) we noticed what appears to be situations where we get all the application cookies and the auth cookie, but not _ASP.NETSessionId cookie.

Is using SystemWebCookieManager is guaranteed to put the original issue of System.Web and Katana messing up each other's cookies to rest or there are scenarios where it might still happen?

Peperud commented 3 years ago

Closing. Sorry for the noise. Different culprit.