ASP.NET 由于核心缓存原因导致Cookie串门

http://support.microsoft.com/kb/917072/en

An ASP.NET page is stored in the HTTP.sys kernel cache in IIS 6.0 when the ASP.NET page generates an HTTP header that contains a Set-Cookie response

View products that this article applies to.

Article ID	:	917072
Last Review	:	December 3, 2007
Revision	:	1.3

SYMPTOMS

Consider the following scenario. A Microsoft ASP.NET page contains the <%@ OutputCache %> directive. Additionally, the ASP.NET page generates an HTTP header that contains a Set-Cookie response. In this scenario, the ASP.NET page is stored in the HTTP protocol stack (HTTP.sys) kernel cache in Microsoft Internet Information Services (IIS) 6.0. Therefore, multiple users who access the same page may receive identical cookies.

Back to the top

WORKAROUND

To work around this problem, use one of the following methods, as appropriate for your situation.

Back to the top

Method 1: Disable kernel mode caching

You can disable kernel mode caching systemwide, or you can disable kernel mode caching for a specific ASP.NET application. This method is the preferred workaround because you can still use output caching in the ASP.NET application. To disable kernel mode caching, follow these steps:

If you want to disable kernel mode caching systemwide, open the Machine.config configuration file. This file is located in the following folder:

Drive:\WINDOWS\Microsoft .NET\Framework\Version\CONFIG

Note Drive is a placeholder for the drive where the operating system is installed. Version is a placeholder for the version number of the Microsoft .NET Framework that is installed.

If you want to disable kernel mode caching for a specific ASP.NET application, open the Web.config configuration file. This file is located in the ASP.NET application folder.

In the configuration file, locate the <httpRuntime> element, and then add the following attribute:

enableKernelOutputCache="false"

Back to the top

Method 2: Disable output caching in a specific ASP.NET page

You can disable output caching in the specific ASP.NET page that generates an HTTP header that contains a Set-Cookie response. However, you must identify every ASP.NET page in the whole application that may generate a cookie. For example, if you are using cookies to maintain the session state, any page that a user accesses may generate a cookie.

To disable output caching in a specific ASP.NET page, delete the <%@ OutputCache %> directive from any .aspx file that you do not want to be cached. For more information about the <%@ OutputCache %> directive in ASP.NET pages, visit the following Microsoft Developer Network (MSDN) Web site:

http://msdn2.microsoft.com/en-us/library/zd1ysf1y(VS.80).aspx (http://msdn2.microsoft.com/en-us/library/zd1ysf1y(VS.80).aspx)

Back to the top

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Back to the top

MORE INFORMATION

For more information about the enableKernelOutputCache attribute in the ASP.NET settings schema, visit the following MSDN Web site:

http://msdn2.microsoft.com/en-us/library/e1f13641.aspx (http://msdn2.microsoft.com/en-us/library/e1f13641.aspx)

For more information about how to configure registry settings for the HTTP.sys kernel mode driver, click the following article number to view the article in the Microsoft Knowledge Base:

820129 (http://support.microsoft.com/kb/820129/) Http.sys registry settings for IIS

Back to the top