Where is session stored if cookie is disabled on client's machine? What is actually stored in session?

Question

In config file I have the below settings

sessionState mode="InProc" cookieless="false"

Does this indicates that the sessionid is stroed in cookies? If yes then how is it picked and sent to the server and how is it verified across postbacks.

What will happen if cookies are disabled in my browser, will the session(sessionid and session variables) still be created?

Where(default path) are the cookies created and stored by default for sessions and can i change the path?

What format and kind of data is stored in cookies for session?

If i store a class object in session then what is actually stored in cookies?

Also if i use authentication mode as forms with cookies then what will happen if cookies are disabled in browser?

Answer 1

The session cookie is a special non-persistant cookie. It's only stored in memory, so in most cases even when cookies are disabled it still works fine.

It's also possible to enable something called cookieless sesssions where the sessionID is embedded in the URL, like this:

http://yourserver/folder/ (encrypted session ID here) /default.aspx

Here's a link to an MSDN article with more details: http://msdn.microsoft.com/en-us/library/aa479314.aspx

NOTE: It is possible to completely block the session cookie. For instance, in IE8, I just went into Tools > Internet Options > Privacy. When I cranked the slider up to 'High' or greater, my sites never got past the login screen because the session cookie was blocked - in fact, Josh Stodola said below that in this case the session would never even be created on the server.

However, understand that this type of behavior effectively breaks the Internet. So unless you're building a site targeted at conspiracy theorists, in my opinion (and the opinion of most of the largest sites in the world) there's no need to cater to the tiny percentage of users who don't play by the normal rules.

For them, the Internet just isn't going to work the way it's supposed to.