I have a situation where I want the asp.net framework 4.8 site to be able to do three things:

  1. Use multiple tabs in the same browser with different sessions in each tab.
  2. Email registration links to work.
  3. Allow Webhooks to work (from Stripe)

I cobbled together a solution which I will post here. The question I have is if anyone can offer feedback on this solution. Is this problematic in some way I am not foreseeing? The solution is in the answer section below.

I'm hoping this makes sense, and doesn't introduce some atrocious vulnerability. But given my requirements, it works, and I'm not seeing any issues with it from a functionality or feature perspective. Any thoughts on this are greatly appreciated. I also wanted to post this here in case this may be of any use to others. I had a hard time finding information on this, and any proposed solution, and so cobbled this together from hints I found in various places, but in particular StackOverflow. Thanks.

1

There are 1 best solutions below

0
On

In web config have this:

 <sessionState cookieless="true" regenerateExpiredSessionId="true" ... />

In the Global.asax have this:

Sub Application_BeginRequest(ByVal sender As Object, ByVal e As EventArgs)
    '================================================================================
    '== NOTE: STRIPE WEBHOOKS FAIL WITH 302 ERROR WHEN THE WEB.CONFIG HAS 
    '         COOKIELESS=TRUE.  THIS CODE FIXES THAT PROBLEM, ALLOWING FOR
    '         COOKIELESS SESSIONS, AND THE USE OF WEBHOOKS.
    '         THE ApplyAppPathModifier() ALLOWS EMAIL LINKS WITHOUT A SESSION
    '         COOKIE TO FIND THE INTENDED PAGE AND LOAD IT CORRECTLY.
    '================================================================================
    If Request.Url.LocalPath.EndsWith("<PutPageNameHere>.aspx") Then
        If Request.Url.PathAndQuery.Contains("<PutParamNameHere>") Then
            Response.ApplyAppPathModifier(Request.Url.PathAndQuery)
        Else
            Response.[End]()
        End If
    End If
End Sub