Creating cookieless application on development machine with asp.net

Question

I tried posting this on ServerFault with no luck so i am trying here.

I am thinking about setting up a new domain to host static content on my website and have it cookieless just like Stackoverflow with their static domain. So before going ahead and buying the domain and setting it up I wanted to test it on my developement machine first under localhost (I have to mention that i am planning on having IIS running on my new domain for the static files).

I therefore created a new application under IIS and disabled session state and forms authentication. When my main application needs resources like css, images and js , I use the path to the "static" application where they are hosted.

The problem is that when I look at the request and the response for the requested files, they still have the session_id cookie defined as well as the asp.net authentication cookie.

Is it at all possible to accomplish what i am trying to do on a development machine or do i have to just go ahead and purchase the new domain which hopefully with make things right? I tried to read about cookieless domain but can't figure out what i might be missing.

Update

My setup was as follows. I created two web applications. - One web application for the website - one web application for everything static (css, images, scripts...)

Both applications are added to IIS and none of them is a sub-application of the other. (They are both separate websites under IIS structure).

I have wondered if having both website under the same IP might have explained my results but when I deployed both sites, the issue disappeared.

Prosperity

Can you describe your setup a bit more? You say you create a new application but you should really create a new website bound to a different IP address and/or port number and/or host name. You can not create a new application under the same website. You need to create two seperate websites. – Gerladina

@MarcoMiltenburg Well, it is not me who asked the question in the first place, I only put the pounty on it. the OP must be asking for a new website on the same machine/IP. Since it is only for development purposes. – Hepato

Sorry for my late response, guys! I was indeed interested in only making this setup work on a development machine and heavily relied on checking request info using firebug to make sure cookies were indeed not used. I indeed felt like the answers below didn't have enough detail but maybe I should have added more information to my question. It turns out that after deploying my static website on a different host, it just "worked". I am going to update my question to include details about my setup. – Prosperity

Have you tried adding a hosts file entry pointing back at your local box so that the browser thinks it's a different domain, and therefore does not sent cookies? – Rafter

Answer 1

Ensure you have the following web.config settings:

• <sessionState mode="Off" />
• <authentication mode="None" />

I think that is all, though I haven't tested it. To be safe, you could use the advice from Creating Static Content Website in IIS 7 which disables all modules and only re-enables them as necessary:

<system.webserver> 
    <modules>
        <clear />
        <add name="StaticFileModule" ... />
        ...
    </modules>
    ...
</system.webserver>

PS: See this answer for tips on setting cache values.

Blackmun

Answer 2

The basic idea:

1. Make a new website in IIS (map it to a subdomain or make it a totally seperate site. Sometimes suddomains aren't enough if users access your site from http://example.com instead of http://www.example.com since in the first case cookies will probably be sent to the new subdomain too).
2. DISABLE ASP.NET all together in IIS for your new site. If you are just serving static content then you don't need ASP.Net enabled
3. Load up your static content and link away

Reference:
- Stopping cookies being set from a domain (aka "cookieless domain") to increase site performance
- How to respect "Serve static content from a cookieless domain" page speed rule in IIS6?
- Avoiding cookies while requesting static content

Muro

Answer 3

The problem is that when I look at the request and the response for the requested files, they still have the session_id cookie defined

This is because HttpRequest.Cookies is property for Request Object.

---

This might helps to understand

• Read, Write, and Delete Cookies in ASP.NET
• Beginner's Guide To ASP.NET Cookies

Mussolini

Answer 4

Have you tried Response.Cookies.Clear() at the end of the Page's Load method? This should eliminate all cookies from the Response object and no cookies will be sent to the client. This could be done in a web module or an HttpHandler as well.

Senlac

Concept he is looking for is not to remove the cookies but not to use them at all – Brattice

So he doesn't want ASP.NET to create a session? Is it what he is looking for? – Sulphurous