title: ASP.NET injects session state into the URL despite the "UseCookies" setting
body: <p>In my ASP.NET MVC3 application I have the following route definitions:</p>
  
  <pre><code>routes.MapRoute( "Sso", "MyController/Sso",
      new { controller = "MyController", action="Sso" } );
  routes.MapRoute( "Settings", "MyController/Settings/{objectId}",
      new { controller = "MyController", action="Settings", objectId = @"" } );
  </code></pre>
  
  <p>and inside <code>MyController</code> I have this:</p>
  
  <pre><code>[My]
  public ActionResult Sso( list of parameters )
  {
      //blah - nothing that would yield a redirect, then
      FormsAuthentication.SetAuthCookie("MagicSso." + someGuid, false);
      return RedirectToAction("Settings", new { objectId = someGuid } );
  }
  </code></pre>
  
  <p>and <code>MyAttribute</code> class inherits from <code>System.Web.Mvc.ActionFilterAttribute</code> and overrides <code>OnResultExecuted()</code> and the latter logs the value of <code>ResultExecutedContext.HttpContext.Response.RedirectLocation</code>.</p>
  
  <p>In test it works just fine and when <code>OnResultExecuted()</code> runs it logs <code>/MyAccount/Settings/some-guid-as-expected-here</code> as redirection target exactly as expected. Also note that <code>objectId</code> is properly mapped so clearly the right route is matched.</p>
  
  <p>However in production the following happens. A request comes to <a href="https://my.domain.name/MyController/Sso" rel="nofollow">https://my.domain.name/MyController/Sso</a> and when <code>OnResultExecuted()</code> runs it logs something like <code>/some-very-long-string-290-characters-long-here/MyAccount/Settings/some-guid-as-expected-here</code> as redirection target. And it looks like that's what the users receive and try to follow - I see requests in HTTPERR logs to this URL coming from the outer worlds and failing with code 400 (bad request).</p>
  
  <p>I'd rather not publish the random string here because I'm not sure if it reveals any sensitive data. It contains the same number of characters every time, always starts with <code>(F(</code> and always ends with <code>))</code> and all the other characters are uppercase and lowercase latin characters and numbers separated with occasional dashes and underscores placed without any obvious rules. Other than that it looks completely random.</p>
  
  <p>After lots of search I'm pretty sure that the weird looking string is the ASP.NET session state sent to the client in "cookieless" fashion. So I checked that in my application <code>System.Web.HttpSessionStateBase.CookieMode</code> returns <code>UseCookies</code> and <code>System.Web.HttpSessionStateBase.IsCookieless</code> returns <code>false</code> and also <code>(System.Web.Configuration.SessionStateSection)System.Web.Configuration.WebConfigurationManager.GetSection("system.web/sessionState").Cookieless</code> returns <code>UseCookies</code>. So I'm more or less sure that ASP.NET is configured to return the session state as cookies no matter what the client prefers.</p>
  
  <p>Why would <code>RedirectToAction()</code> suddenly inject some random looking string similar to encoded session state into the redirect target?</p>