 | A user who accesses your web application, with cookies blocked, may report that they are unable to login to your web site. Upon clicking the login button, nothing will happen. This is because without cookies enabled, session state is unable to be stored. This can create increased technical support issues for your staff. This is why enabling your web application with cookie detection is an important task. |
Cookieless Session State The easiest solution to a user who may be blocking cookies would be to set the web application's web.config file to use cookieless session state. Cookieless session state means that the session ID variable is passed within the URL of your web application. For example, your URL will become:
http://www.myapplication.com/(sllrueyucbnxxi4345uff3/login.aspx To configure cookieless session state, you add the following definition to your web.config file in place of the usual tag: <sessionState cookieless="true" timeout="20" /> While this may seem like a reasonable solution, it is often more work to manipulate session variables, as you have to take into account the URL parameter session ID. The URL itself, also becomes harder for search engines to read. In fact, Google has been known to ignore spidering pages with excessive URL parameters. A Better Solution A better solution is to follow in the footsteps of the big web application players, such as Google and Microsoft. If you try turning off your cookies and visit hotmail.com or google.com/preferences, you will notice they automatically detect that you are blocking cookies. This is the same technique described below to enable your web application with this feature. Detecting Blocked Cookies in C# ASP.NET  | Since detecting cookies takes a round-trip to the server and back (one trip to set the cookie, one trip to read the cookie we just set), we want to make this as quick as possible in order to put the least load on the server. |
The basic idea to detecting blocked cookies is to first check if a certain parameter is in the URL. If it is not there, we will proceed to set a cookie and refresh the page with a parameter in the URL (to indicate on the next reload to perform the test). When the parameter is seen in the URL, we perform the test by trying to read the cookie. If it exists, cookies are enabled. Otherwise, cookies are blocked. The following code example shows how to detect blocked cookies in C#. This code would be placed within the first page users will access on your site (usually default.aspx or Global.ascx). // Cookie detection.
// Is our cookie not yet set and the url parameter empty? If so, lets set the cookie.
if (Session["CookieCheck"] == null && Request.QueryString["c"] == null)
{
// Set the cookie and redirect so we can try to detect it.
Session["CookieCheck"] = "1";
Response.Redirect("default.aspx?c=1", true); return;
}
else
{
// Detect the cookie.
if (Session["CookieCheck"] == null || Session["CookieCheck"].ToString() != "1")
{
// Cookies are disabled
Response.Redirect("NoCookies.aspx", true);
return;
}
} |