javascript - aspsessionid name change - Stack Overflow

admin管理员组

文章数量:1324844

<script type="text/javascript" language="javascript">
function setCookie()
{
    var path = '/', host = document.location.hostname;
    document.cookie = 'random=' + Math.floor(Math.random()*11) + '; path=' + path + ( host ? '; domain=' + document.location.hostname : "" ) ;
}
function readCookie()
{
    alert(document.cookie)
}
</script>

My life would be a lot simpler if I had an easy way to change aspsessionid**** to just sessionid in my logs. Is there a quick way to do this ... in Windows? There must be a script, batchfile, mand or something that I can run as a scheduled daily task on new logfiles. At times like this I wish I could program. Suggestions wele please!

<script type="text/javascript" language="javascript">
function setCookie()
{
    var path = '/', host = document.location.hostname;
    document.cookie = 'random=' + Math.floor(Math.random()*11) + '; path=' + path + ( host ? '; domain=' + document.location.hostname : "" ) ;
}
function readCookie()
{
    alert(document.cookie)
}
</script>

My life would be a lot simpler if I had an easy way to change aspsessionid**** to just sessionid in my logs. Is there a quick way to do this ... in Windows? There must be a script, batchfile, mand or something that I can run as a scheduled daily task on new logfiles. At times like this I wish I could program. Suggestions wele please!

• javascript
• asp
• iis-7
• asp-classic

Share Improve this question Follow edited Jun 18, 2012 at 11:53 Frank 1,05633 gold badges1818 silver badges3838 bronze badges asked Oct 21, 2011 at 19:22 Gürkan PalaGürkan Pala 23333 silver badges1111 bronze badges 4

• what ???????? do you mean the "ASP.NET_SessionId." cookie ? – Royi Namir Commented Nov 16, 2011 at 15:00
• @frank is not so clear (for me) what you actually search here. You need to change this cookie name on your logs with a search/release ? or do you won to change this on asp ? - or do you won to change this on asp Please be more clear – Aristos Commented Jun 18, 2012 at 11:26
• Bounty started on this question but the description attached to the bounty varies quite a bit from the actual question. – AnthonyWJones Commented Jun 18, 2012 at 21:23
• If I am not wrong you want to secure your aspsession in cookie, you should check stackoverflow./questions/953361/… – Ravi Vanapalli Commented Jun 19, 2012 at 12:30

Add a ment  | 

4 Answers 4

Sorted by: Reset to default 5 +200

There is no option (known or documented - available to the public) to change the name of aspsessionids (classic asp).

You can disable the session (ASP -> Session Properties -> Enable Session State: false) from IIS or by using the @ENABLESESSIONSTATE directive and move on with your own cookies served from asp (and not by JavaScript). But this is OK only if you don't need the session object in your application.

A better approach is to change these "strings" in log files using Regex (asp version is already presented by Anthony W Jones) or by (minimal simplified C# sample):

Regex rx = new Regex("ASPSESSIONID[A-Z]+=");

string log = rx.Replace(File.ReadAllText("u_ex120618.log"), "ASPSESSIONID=");
Console.WriteLine(log);

More about aspx and IIS

One option is to use a handler to remove headers.

public class RemoveHttpHeadersModule : IHttpModule
{
    public RemoveHttpHeadersModule()
    {
    }

    public void Dispose()
    {
    }

    public void Init(HttpApplication context)
    {
        if (context != null)
                context.PreSendRequestHeaders += this.OnPreSendRequestHeaders;
    }

    [SuppressMessage("Microsoft.Portability", "CA1903:UseOnlyApiFromTargetedFramework", MessageId = "System.Web.HttpResponse.#get_Headers()")]
    private void OnPreSendRequestHeaders(object sender, EventArgs e)
    {
        try
        {
            HttpContext.Current.Response.Headers.Remove("ETag");
            HttpContext.Current.Response.Headers.Remove("Server");
            HttpContext.Current.Response.Headers.Add("Server", "my server");
        }
        catch (HttpException)
        {
            throw;
        }
    }
}

Another option is to control everything in global.asax (code or piled library) - covering the case you don't have access to IIS manager.

Remove (and/or add) headers:

protected internal void Application_PreSendRequestHeaders(object sender, EventArgs e)
{
    HttpContext.Current.Response.Headers.Remove("X-AspNet-Version");
    HttpContext.Current.Response.Headers.Remove("X-Powered-By");
    HttpContext.Current.Response.Headers.Remove("ETag");
    HttpContext.Current.Response.Headers.Remove("Server");
}

Handle errors

protected internal void Application_Error(object sender, EventArgs e)
{
    // get the error code            
    int ec = ((HttpException)HttpContext.Current.Error).GetHttpCode();
    // get the request path
    // string req = HttpContext.Current.Request.Path;
    // *** I suggest you to log the error before moving on
    // clear the error to avoid IIS actions
    HttpContext.Current.Server.ClearError();
    if (ec == 404)
    {
        // do what ever you want
    }
    // ... add other error codes handling;
}

The next step is to hide aspx.

Assume that we want our .aspx pages presented as .html This is answered here: What is the proper way to map .html to the ASP.NET pipeline in IIS7

Just take care to select the correct framework version. If you don't have access to IIS manager, then modify your web.config (presenting only what is needed for this task):

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <handlers>
            <add name="htmlpipe" path="*.html" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
        </handlers>
    </system.webServer>
</configuration>

The above setting may differ to your pc, server etc. Having a testing environment with the same basic attributes (framework version, 32/64bit), make the change in your IIS and then check the generated entry in your web.config.

Allow me to make a joke. "Do you like this product?"

Thank you Frank, you made be plug some old disks and find things that were forgotten. I'm sorry for not having suggestions for classic ASP.

PS. Don't forget the answer by HackedByChinese.

If you are using .NET 2.0 or greater, you can change the cookie name via web.config.

<configuration>
   <system.web>
      <sessionState cookieName="sessionid" />
   </system.web>
</configuration>

The answer to the bounty description is: "not really".

The only thing you can do is stop using session object altogether and disable sessions. You would therefore you need to create your own session management (storing data in a DB for example) and track your own sessions with a cookie.

The following is an answer to the original (now quite old question).

Here is a VBScript function which will replace the ASPSessionIDxxxxxxxx= in a log file (I'm assuming the standard IIS logfiles with cookie logging enabled).

Sub ReplaceASPSessionIDInLog(path)

    Dim fso :  Set fso = CreateObject("Scripting.FileSystemObject")

    Dim stream : Set stream = fso.OpenTextFile(path)
    Dim input: input = stream.ReadAll()
    stream.close()

    Dim rgx : Set rgx = new RegExp
    rgx.Pattern = "ASPSESSIONID.+(?=\=)"
    rgx.Global = True
    rgx.IgnoreCase = True

    Dim output : output = rgx.Replace(input, "SESSIONID")

    Set stream = fso.OpenTextFile(path, 2)
    stream.Write output
    stream.close()

End Sub

This code works if you want to get rid of all session cookies except the last one created:

Sub DeleteOldSession(logincookiename)

    Dim strSessionCookie, arrSessionCookie, i, a
    i = 0
    a = 1

    strSessionCookie = Request.ServerVariables("HTTP_COOKIE")

    if strSessionCookie <> "" then

    Dim intCookieValueStart, intCookieValueEnd, intCookieValueLength, strSessionCookieName, strSessionCookieValue

        arrSessionCookie = Split(strSessionCookie,";")

        if Ubound(arrSessionCookie) > 0 then

            if InStr(strSessionCookie,logincookiename) = 0 then a = 0

            if Ubound(arrSessionCookie) > a AND InStr(arrSessionCookie(Ubound(arrSessionCookie)),"NULL") = 0 then

                For i = 0 to Ubound(arrSessionCookie)
                    if i >= a AND InStr(arrSessionCookie(i),"ASPSESSIONID") then
                        intCookieValueStart = InStr(arrSessionCookie(i),"=")
                        intCookieValueEnd = Len(arrSessionCookie(i))
                        intCookieValueLength = intCookieValueEnd - intCookieValueStart
                        strSessionCookieName = Mid(arrSessionCookie(i),1,intCookieValueStart-1)
                        strSessionCookieValue = Mid(arrSessionCookie(i),intCookieValueStart+1,intCookieValueLength)
                        response.write("<script type=""text/javascript"">")
                        response.write("setCookie('" & strSessionCookieName & "','NULL',0)")
                        response.write("</script>")
                        'if lngUser = 1 then response.write("<p class=""alert"">" & strSessionCookieName & "</p>")
                    end if
                Next

            end if

        end if

    end if

end sub

本文标签： javascriptaspsessionid name changeStack Overflow