Cookies in global.asa

[ou812]

Set IE 6.0 ver. X to "Block all Cookies" in privacy settings and try
this code in three separate files.

<-- Global.asa -->
sub Session_OnStart
response.cookies("test") = "-1"
end sub
<-- Global.asa -->

<-- testcookie1.asp -->
<%Response.Redirect("testcookie2.asp")%>
<-- testcookie1.asp -->

<-- testcookie2.asp -->
<%=request.cookies("test")%>
<-- testcookie2.asp -->

I get "-1" on testcookie2.asp

Anyone else get the same result?
Why am I getting the cookie in this test?

 

[Aaron [SQL Server MVP]]

Is global.asa on your own machine? Are you sure you set the block in that
zone?

 

[ou812]

On Thu, 24 Jun 2004 16:34:50 -0400, "Aaron [SQL Server MVP]"

Nope. The script runs on a commercial host in Canada, not on my
intranet. All I wanted to do was "test" for cookies and I found that
this would just "take" the cookie regardless of the browser settings.


I guess it's taking the cookie because it IS displaying a string
value, although the privacy report (via the icon at the bottom of the
page) states it "blocked" cookies on pages.

 

[Mark Schupp]

I am not familiar enough with cookies to be sure but you are setting the
cookie with every request.

If all cookies are blocked then session_onstart will fire for every request
(each request will be a new session).

 

[Zenobia]

On Thu, 24 Jun 2004 16:34:50 -0400, "Aaron [SQL Server MVP]"

Nope. The script runs on a commercial host in Canada, not on my
intranet. All I wanted to do was "test" for cookies and I found that
this would just "take" the cookie regardless of the browser settings.

I guess it's taking the cookie because it IS displaying a string
value, although the privacy report (via the icon at the bottom of the
page) states it "blocked" cookies on pages.

Maybe the browser just blocks permanent cookies which are stored
on disk after the session's over? ASP session cookies are only
temporary and are destroyed when the session ends. To set a
permanent cookie with ASP give the cookie an expiry date.
Compare how it behaves with both types: permanent and sessional.

A browser that blocked all cookies wouldn't work with ASP.