title: Classic ASP/IIS 6.0 session cookie length
body: <p>IIS 6.0 uses the following format for session ID cookies</p>
  
  <p>Set-Cookie: ASPSESSIONIDACTCRDDR=EMGFKIKAPMLMCAJPOAPNKADG;</p>
  
  <p>where the part after ASPSESSIONID is random. The random part is not very long and valid session IDs can be guessed. </p>
  
  <p>Is there a way to configure IIS 6 to make the cookie longer and thus more secure? </p>
  
  <p>Do you know whether the format is the same for IIS 7 or higher? </p>