Why is the iis 7.5 creating multiple ASPSESSIONID cookies in classic asp

asp-classiciis-7.5

I have Windows Home Server 2011 SP1 64bit. It's running IIS 7.5 and has a classic asp app on it. I'm getting per-client slowdowns every now and then. By this I mean that one specific browser will behave as if the server is not found. Other browsers on the same machine are fine, and other machines on the network are also fine.

I installed IIS7.5, then added my classic asp app. I configured the app pool to allow 32-bit access for my com, and I configured IIS to send me the actual errors. I've set common http headers – "http keep alive" and "expire web content immediately", to see if they help (no). This is about all I've changed.

The app doesn't have a database. It doesn't use integrated authentication. It doesn't interop with dotnet. It's not doing anything clever or complicated. If I reduce the problem to a page that sets a cookie and nothing else, the problem still comes up after a while.

Upon inspection of the browser when this happens, there are always multiple ASPSESSIONID cookies (e.g. more than 30). They look like this:

Cookie:ASPSESSIONIDSCRQTCBT=JCFJPAHDDFOOBJCDHCIPHDCH; ASPSESSIONIDCQQSTQAC=MAJHOOJCFEDLCLPNALLILMCL; ASPSESSIONIDAQTTRQBD=OGIPPIFDHODGGANGGPPJFJGI; ASPSESSIONIDQCCQCRBC=IINDIKMBMNABDJKMCKMFMFOF; __utma=104959943.97773051.1372652641.1372652641.1372652641.1; __utmc=104959943; ASPSESSIONIDSQDRCSCQ=JHCNKOADBNKDMCLKFFCCINJD; ASPSESSIONIDQSQQDDSQ=OLFFMCCDBBNCLDKEFEAEIONM; ASPSESSIONIDSSSBTCCD=NBLNLHMBEOANIGDHHLFHNENH; ASPSESSIONIDACQRATQT=DKJNFHODFIDJJBFEFMBEBBLB; ASPSESSIONIDQSSSRTDD=ICCNACFCIPMAHJEPHDJBNMPA; ASPSESSIONIDASDBABDS=PANLJLOCMFAFGHEEEGAPJNPM; ASPSESSIONIDASAACACS=PIDJNIPCLOJCKINLBLCBPJED;

etc ..

This horror is eventually followed by the couple of actual cookies I've set. I don't USE this ASPSESSIONID- what is it for, can I get rid of it? Is it likely to be a cause of my slowdown?

Best Answer

It is very unlikely that the ASPSession cookie(s) have anything to do with your problem.

If you don't use session state within your ASP site, you can turn if off in IIS.

In IIS manager, select your site and click the ASP icon, at the bottom expand Session Properties and set Enable Session State to False, you will no longer have that cookie.

Why are there two? The classic ASP engine sets a cookie when it creates a session for a user, if for any reason, it looses that session (like the AppPool is recycled) it sets a new cookie for a new session. The browser keeps the old one, because it doesn't know that it is no longer valid the server.

Related Topic