Multiple ASPSESSIONID in cookies Not Resolved

Question

I have problems like in this example I also create that script:

<% If trim(Session("test_val")) = "" Then
     Dim my_num
     Randomize
     number = Int((rnd*1000))+1
     Session("test_val") = number
   End If
%>

<b>Session ID:</b>
<% response.write(Session.SessionId) %><br /><br />

<b>Session("test_val"):</b>
<% response.write(Session("test_val")) %><br /><br />

<b>Session Timeout:</b>
<% response.write(Session.Timeout) %> minutes<br /><br />

<b>Server Software:</b>
<% response.write(Request.ServerVariables("SERVER_SOFTWARE")) %><br /> <br />

<b>HTTP_COOKIE:</b> <% response.write(Request.ServerVariables("HTTP_COOKIE")) %>

After each page request I got a different result

Session ID: 619163854

Session("test_val"): 784

Session Timeout: 480 minutes

Server Software: Microsoft-IIS/8.5

HTTP_COOKIE: ASPSESSIONIDQQATDABC=EMAJHOECJIKDFKKHFFKIGDEK

and

Session ID: 619245915

Session("test_val"): 39

Session Timeout: 20 minutes

Server Software: Microsoft-IIS/8.5

HTTP_COOKIE: ASPSESSIONIDQQATDABC=EMAJHOECJIKDFKKHFFKIGDEK; ASPSESSIONIDQSDTCDCB=OMALHOECNLEJLAHGOJEGDNIJ; ASPSESSIONIDQSATDBAD=EFBPIOECEIAAAGKFOJMECCOM; ASPSESSIONIDQQCTCAAC=LFBPIOECGGPIJAINBPKIDNFF

And every refresh ASPSESSIONID still appending to cookies

web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
          <rewriteMaps>
            <clear />
            <rewriteMap name="Static URL Rewrites">
              <add key="/robots.txt" value="/robots.asp" />
              <add key="/sitemap.xml" value="/sitemap.asp?format=XML" />
              <add key="/sitemap.txt" value="/sitemap.asp?format=TXT" />
            </rewriteMap>
            <rewriteMap name="Static URL Failures">
              <add key="/robots.asp" value="/" />
              <add key="/sitemap.asp" value="/" />
            </rewriteMap>
          </rewriteMaps>
          <rules>
            <clear />
            <rule name="Static URL Rewrites" patternSyntax="ECMAScript" stopProcessing="true">
              <match url=".*" ignoreCase="true" negate="false" />
              <conditions>
                <add input="{Static URL Rewrites:{REQUEST_URI}}" pattern="(.+)" />
              </conditions>
              <action type="Rewrite" url="{C:1}" appendQueryString="false" redirectType="Temporary" />
            </rule>
            <rule name="Static URL Failures" patternSyntax="ECMAScript" stopProcessing="true">
              <match url=".*" ignoreCase="true" negate="false" />
              <conditions>
                <add input="{Static URL Failures:{REQUEST_URI}}" pattern="(.+)" />
              </conditions>
              <action type="CustomResponse" statusCode="404" subStatusCode="0" />
            </rule>
            <rule name="Prevent rewriting for static files" patternSyntax="Wildcard" stopProcessing="true">
              <match url="*" />
              <conditions>
                 <add input="{REQUEST_FILENAME}" matchType="IsFile" />
              </conditions>
              <action type="None" />
            </rule>

          </rules>
        </rewrite>
        <defaultDocument>
            <files>
                <remove value="default.aspx" />
                <remove value="iisstart.htm" />
                <remove value="index.html" />
                <remove value="index.htm" />
                <remove value="Default.asp" />
                <remove value="Default.htm" />
                <add value="index.asp" />
            </files>
        </defaultDocument>
        <directoryBrowse enabled="false" />
        <httpErrors errorMode="DetailedLocalOnly" defaultPath="D:\err.html">
            <remove statusCode="401" subStatusCode="-1" />
            <remove statusCode="403" subStatusCode="-1" />
            <remove statusCode="404" subStatusCode="-1" />
            <remove statusCode="405" subStatusCode="-1" />
            <remove statusCode="406" subStatusCode="-1" />
            <remove statusCode="412" subStatusCode="-1" />
            <remove statusCode="500" subStatusCode="-1" />
            <remove statusCode="501" subStatusCode="-1" />
            <remove statusCode="502" subStatusCode="-1" />
        </httpErrors>
        <urlCompression doStaticCompression="false" doDynamicCompression="false" />
        <httpProtocol>
            <customHeaders>
                <remove name="X-Powered-By" />
            </customHeaders>
        </httpProtocol>
        <security>
            <requestFiltering>
                <requestLimits maxAllowedContentLength="4290000000" />
            </requestFiltering>
        </security>
    </system.webServer>
    <system.web>
        <sessionState mode="Off" />
    </system.web>


</configuration>

I have 1 app pool why:

Session Timeouts is changed?
ASPSESSIONID multiplying?

I have edited your title. Please see, "[Should questions include “tags” in their titles?](http://meta.stackexchange.com/questions/19190/)", where the consensus is "no, they should not". — John Saunders, May 08 '15 at 11:32

Zam · Accepted Answer · 2015-05-08T11:36:06.623

1

https://msdn.microsoft.com/en-us/library/h6bb9cz9(v=vs.71).aspx

Please change your

<system.web>
        <sessionState mode="Off" />
</system.web>

or delete this section

edited May 08 '15 at 11:36

answered May 08 '15 at 11:35

Zam

2,880
1
18
33

First time i give incorrect answer. Can you change OFF to InProc – Zam May 08 '15 at 11:37
But how with OFF switch Session can work at all? No one of existing switch do not solve this problem – Dmitrij Holkin May 08 '15 at 11:38
may be something else in your project messup with Session? can you create in IIS blank Web and Pool Application, and put only one single ASP page with code from your sample? do not put web.config into new Web app. what we doing -- we just trying to verify that issue not on server (IIS/OS) itself and not on this page. – Zam May 09 '15 at 21:54
I have `` set in my web.config and I notice that if I delete the sessionState line it allows these cookies to be secure, but when I keep``? – Coded Container Feb 09 '18 at 15:04

Multiple ASPSESSIONID in cookies Not Resolved

1 Answers1