Session Vars and Cookie Settings

Is it the IE Cookie settings that are messing things up?

[ChrisB]

I've been doing a lot with general web site design and development in ASP for a while, but its always been quite basic stuff.

I've now just completed a new project in which I use ASP session variables to hold stuff like user names and user specific settings in. And everything works fine on my computer (doesn't it always?!), but when my friend tries her login, I get problems. I've done a little more reading and I think its the cookie settings. She is using an internet cafe computer so she cant change or even view the cookie settings. I'm not actually setting any cookies, but does using session variables create cookies? If the IE settings do not allow session cookies this will make all the logon attempts fail because I'm storing the user name in a session variable!

Surely this would be a common problem with a lot of websites when used in internet cafes?
Or am I going about this in the wrong way?
Should I be using some other method other than session variables to store this kind of information so that it will work on computers with tight cookie settings? and if so what should I be looking at?

Many thanks for any help,
ChrisB.

[RossWal]

Session vars do use cookies to track the session. Your other choices include passing stuff in the query string or in hidden form fields. You can keep the data serverside (database, xml flat file), but you need to track the session/user somehow. Another scheme to consider would be using the ip address to track the session, but it's not infailable.

HTH,
Ross

[mattglet]

Another scheme to consider would be using the ip address to track the session, but it's not infailable.

especially for AOL users, where their IP can change with one click of a hyperlink. i'm pretty sure AOL users go through random proxy servers throughout the whole time they are connected, and the proxy server issued IP can change at any time.

-Matt

[chadmg]

Yes, IE privacy settings need to be set at Medium High or lower for session cookies to work. My point of view is that if someone doesn't want cookies than they should expect to not have the benefits that come with cookies. You most likely won't be able to buy anything from an online store without cookies. And for those using internet cafes, who don't have a choice, they'll have to get their own computers.

So to accomodate for this you should perform checks for cookies and provide either an alternate solution if the un-cookied are important to you or at least an error message telling them they need cookies.

A cookie is a way for a website to tell who you are. If your site requires a login but the user doesn't want you knowing who they are, then he shouldn't be able to log in. Most people have learned this, and accept that cookies are here to stay. Thats my 2 cents.