.net - ASP.NET injects session state into the URL despite the "UseCookies" setting -

in asp.net mvc3 application have following route definitions:

routes.maproute( "sso", "mycontroller/sso",     new { controller = "mycontroller", action="sso" } ); routes.maproute( "settings", "mycontroller/settings/{objectid}",     new { controller = "mycontroller", action="settings", objectid = @"" } ); 

and inside mycontroller have this:

[my] public actionresult sso( list of parameters ) {     //blah - nothing yield redirect,     formsauthentication.setauthcookie("magicsso." + someguid, false);     return redirecttoaction("settings", new { objectid = someguid } ); } 

and myattribute class inherits system.web.mvc.actionfilterattribute , overrides onresultexecuted() , latter logs value of resultexecutedcontext.httpcontext.response.redirectlocation.

in test works fine , when onresultexecuted() runs logs /myaccount/settings/some-guid-as-expected-here redirection target expected. note objectid mapped right route matched.

however in production following happens. request comes https://my.domain.name/mycontroller/sso , when onresultexecuted() runs logs /some-very-long-string-290-characters-long-here/myaccount/settings/some-guid-as-expected-here redirection target. , looks that's users receive , try follow - see requests in httperr logs url coming outer worlds , failing code 400 (bad request).

i'd rather not publish random string here because i'm not sure if reveals sensitive data. contains same number of characters every time, starts (f( , ends )) , other characters uppercase , lowercase latin characters , numbers separated occasional dashes , underscores placed without obvious rules. other looks random.

after lots of search i'm pretty sure weird looking string asp.net session state sent client in "cookieless" fashion. checked in application system.web.httpsessionstatebase.cookiemode returns usecookies , system.web.httpsessionstatebase.iscookieless returns false , (system.web.configuration.sessionstatesection)system.web.configuration.webconfigurationmanager.getsection("system.web/sessionstate").cookieless returns usecookies. i'm more or less sure asp.net configured return session state cookies no matter client prefers.

why redirecttoaction() inject random looking string similar encoded session state redirect target?

turns out there're 2 separate settings - 1 system.web/sessionstate , other 1 system.web/authentication/forms/cookieless , have different values default. latter has usedeviceprofile default , inject forms authentication token url.

in our case configuration made no sense - if user has no cookies support can't use our site because relies on cookies heavily, changes system.web/authentication/forms/cookieless usecookies.