title: asp_sessionid cookie default path to be made application specific
body: <p>I have a website in which I had to make the default path which is usually visible as "/" for asp.netSessionId cookie and .ASPXAUTH cookie to application specific for security reasons and after lot of RND i was able to do that but I have a confusion and a problem now described as follows:</p>
  
  <ol>
  <li><p>The confusion is: In order to make the cookie path application specific I wrote a method say "setcookiepath" to do so and called that method from global file's session_start but that did not work that as the path either used to get reset sometime after certain clicks or more than 1 cookie got generated one with default path and other with app specific path. So I went ahead and called my method 1 by 1 from other events in global.asax file and finally ended up calling from each one, still it worked only sometimes. Then I abandoned session in my Session_Start only the first time when Application is called by using a flag that i set in application_start and reset after session abandons in session_start. This time it worked perfectly fine. Now, i tried removing unneccesary calls from setcookiepath and tested this time it is working with single method call in any of the events and even after removing the logic of abandoning session it is working now.I am confused what is the right approach?</p></li>
  <li><p>The problem is: Although now my code is working for the website but there is an Admin module which is called from a sub folder within that website. For this Admin sub module my code is not working i.e. the problem I am facing is. I am able to login to Admin module the first time I hit the url and 2 cookies get generated for ASP.NetSessionId one with default path and the other has application specific path. This works as long as my browser is open, when I close the browser and try to relogin, now my previous session cookies are removed and I keep getting redirected to login page because the user session gets invalidated in between somewhere when I am redirecting from login page to home page for Admin module, this issue is not occuring in main website module. Also, after removing the path reset logic from global.asax.cs file admin module session works fine between login and home page.</p></li>
  </ol>
  
  <p>Please help.</p>
  
  <p>Code for path set is :</p>
  
  <pre><code>public void setCookieApp()
          {
              if (HttpContext.Current != null)
              {
                  /// only apply session cookie persistence to requests requiring session information   
                  if (HttpContext.Current.Handler is IRequiresSessionState || HttpContext.Current.Handler is IReadOnlySessionState)
                  {
                      SessionStateSection sessionState = (SessionStateSection)ConfigurationManager.GetSection("system.web/sessionState");
                      string cookieName = sessionState != null &amp;&amp; !string.IsNullOrEmpty(sessionState.CookieName) ? sessionState.CookieName : "ASP.NET_SessionId";
                      string cookieName1 = sessionState != null &amp;&amp; !string.IsNullOrEmpty(sessionState.CookieName) ? sessionState.CookieName : ".ASPXAUTH";
                      //System.TimeSpan timeout = sessionState != null ? sessionState.Timeout : TimeSpan.FromMinutes(20);
                      /// Ensure ASP.NET Session Cookies are accessible throughout the subdomains.     
                      if (HttpContext.Current.Request.Cookies[cookieName] != null)
                      {
                          //Response.Cookies[cookieName].Value = Session.SessionID;
                          HttpContext.Current.Response.Cookies[cookieName].Path = HttpContext.Current.Request.ApplicationPath;
                          //Response.Cookies[cookieName].Expires = DateTime.Now.Add(timeout);
                      }
                      if (HttpContext.Current.Request.Cookies[cookieName1] != null)
                      {
                          //Response.Cookies[cookieName].Value = Session.SessionID;
                          HttpContext.Current.Response.Cookies[cookieName1].Path = HttpContext.Current.Request.ApplicationPath;
                          //Response.Cookies[cookieName].Expires = DateTime.Now.Add(timeout);
                      }
                  }
  
                  foreach (string k in HttpContext.Current.Request.Cookies.AllKeys)
                  {
                      if (k.ToString().Contains("ASP.NET_SessionId"))
                      {
                          HttpContext.Current.Response.Cookies["ASP.NET_SessionId"].Path = HttpContext.Current.Request.ApplicationPath;
                      }
                      else if (k.ToString().Contains(".ASPXAUTH"))
                      {
                          HttpContext.Current.Response.Cookies[".ASPXAUTH"].Path = HttpContext.Current.Request.ApplicationPath;
                      }
                  }
              }
          }
  </code></pre>