You may be redirected to the forms authentication logon page, or you may receive an error message when you try to run an application that is built by using the .NET Framework 2.0

View products that this article applies to.

SYMPTOMS

When you try to run an application that is built by using the Microsoft .NET Framework 2.0, you may be redirected to the forms authentication logon page. Alternatively, you may receive an error message that resembles the following:

Server Error in '/WebSites1' Application.
--------------------------------------------------------------------------------

Object reference not set to an instance of an object.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.NullReferenceException: Object reference not set to an instance of an object.

Note You may experience other problems that are caused by session loss.

This problem may occur when one or both of the following conditions are true:

You migrate a Web application from the .NET Framework 1.1 to the .NET Framework 2.0.
You use a script, a Java applet, or a Microsoft ActiveX control on the client side to perform a request in a Web application.

Back to the top

CAUSE

This problem occurs because the HttpOnly attribute prevents any client script from accessing the session cookie. The HttpOnly attribute is added to the session cookie in the .NET Framework 2.0.

Back to the top

RESOLUTION

To resolve this problem, set the HttpOnly attribute for the session cookie to the false value.

Note Setting the HttpOnly attribute to the true value does not prevent a malicious user from accessing the cookie directly when the malicious user has access to the network channel. Consider using Secure Sockets Layer (SSL) to help protect against this. Workstation security is also important. A malicious user may use an open browser window or a computer that contains persistent cookies to access a Web site by using a legitimate user's identity.

To set the HttpOnly attribute to the false value, replace the Session_Start method in the Global.asax file by using the following code.

   void Session_Start(object sender, EventArgs e)
        {
            if (Response.Cookies.Count > 0)
            {
                foreach (string s in Response.Cookies.AllKeys)
                {
                    if (s == System.Web.Security.FormsAuthentication.FormsCookieName || s.ToLower() == "asp.net_sessionid")
                    {
                        Response.Cookies[s].HttpOnly = false;
                    }
                }
            }
        }

Note If you want to reuse this code in multiple applications, put this code in a custom HttpModule class.

Back to the top

MORE INFORMATION

For more information about the HttpOnly attribute, visit the following Microsoft Developer Network (MSDN) Web site:

http://msdn2.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx (http://msdn2.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx)

For more information about the HttpModule class, visit the following MSDN Web site:

http://msdn2.microsoft.com/en-us/library/zec9k340(vs.71).aspx (http://msdn2.microsoft.com/en-us/library/zec9k340(vs.71).aspx)

For more information about breaking changes in the .NET Framework 2.0 and in the HttpOnly attribute, visit the following MSDN Web site:

http://msdn2.microsoft.com/en-us/netframework/aa497240.aspx (http://msdn2.microsoft.com/en-us/netframework/aa497240.aspx)

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

Back to the top