Managing Anonymous Users

With ASP.NET 2.0, anonymous users are not that anonymous anymore. Now you have the option to automatically assign an ID to unknown users. This ID will either be saved in a persistent cookie or in the URL. If a cookie is used, you can recognize the anonymous user on a later visit.

The use of a unique ID for anonymous users offers important advantages. You can save information about such users in your database, even without any login or registration information submitted from that person. This particularly applies to personalization, which I'll explain to you in the next chapter. The anonymous ID can be used automatically in that situation!

By default, the generation of an anonymous user ID is deactivated. Activation through the web.config configuration file is similar to the following:

<?xml version="1.0"?>
<configuration>
    <system.web>
        <anonymousIdentification
            enabled="true"
        />
    </system.web>
</configuration>

By means of additional parameters, you can specify the cookie to be used. You may as well change the expiration time, which is set to 100,000 minutes as a standard (with sliding expiration). Additionally, you may define whether the ID should be saved in a cookie or in the URL. When using the setting UseDeviceProfile, this will depend on the utilized device/browser.

Please keep in mind that the user is displayed as not logged on while the anonymous ID is used. Consequently, the ID can't be queried by the allocated IIdentity object. Instead, the ID is accessible via the AnonymousId property of the HttpRequest class. The ID is delivered as a GUID that has been transformed into the following string by the Request.AnonymousId property (see Figure 6-13):

... = this.Request.AnonymousId

Figure 6-13: ASP.NET automatically generates an anonymous user ID.