What is the .AspNetCore.Session cookie?
.AspNetCore.Session is a cookie generated automatically by the ASP.NET Core framework (Microsoft) when a web application enables session state middleware. It is not specific to any single website; it appears on any .NET application that uses this feature to preserve information across multiple requests from the same visitor.
The cookie is set as soon as a visitor accesses a page that requires session state, for example a shopping cart, a multi-step form, or an authenticated area. It is set by the server, not by client-side scripts.
What data it stores
The cookie's value is a server-generated session identifier (an encoded string with no meaning readable by the visitor). The actual session data, such as shopping cart contents or form progress, is stored on the server, not inside the cookie itself.
The exact value format can vary depending on the application's configuration and is not publicly standardized. The cookie is sent only to the domain that set it, back to that application's server.
What it is used for
Its main purpose is to let the server recognize that successive requests come from the same visitor within the same browsing session. Without it, the application would treat every request as coming from a new user, breaking features such as shopping carts, multi-step forms, or a persistent login session.
It is a purely technical cookie used to run the application, not for analytics, marketing, or cross-site tracking.
Does it require consent?
Under CookieFix's classification, .AspNetCore.Session falls into the „strictly necessary” category. Under the ePrivacy Directive (transposed in Romania via Law 506/2004) and GDPR interpretation, cookies strictly necessary to provide a service explicitly requested by the user, such as maintaining a shopping cart session, do not require prior consent.
- No banner acceptance is needed for this cookie.
- The site owner must still disclose it in the cookie policy, with its purpose and duration.
- If the session is also used for additional purposes, such as profiling or marketing, reclassification and consent may become necessary.
How to block or delete .AspNetCore.Session
A visitor can delete or block this cookie from browser settings (Chrome, Firefox, Edge, and Safari all allow deleting per-site cookies or blocking cookies entirely). Blocking it can break features such as a shopping cart or a login session, since the application will no longer be able to preserve state across pages.
Because it is strictly necessary, this cookie should not be blocked by a CMP before consent, as that would affect the site's basic functionality. A platform like CookieFix can still detect it automatically during a scan and list it correctly as „necessary” in the cookie policy, without blocking it.
Frequently asked questions
It is a technical cookie set by ASP.NET Core applications to maintain a visitor's session state on the server, for example the contents of a shopping cart.
No, as a strictly necessary cookie for the application to function, it does not require consent under ePrivacy and GDPR, but it must be disclosed in the cookie policy.
It is typically a session cookie, so it expires automatically when the browser closes or when the server-side session expires.
The current session is lost, and actions like a filled shopping cart or a multi-step form in progress may be reset.