Selenium IDE, deleteAllVisibleCookies and ASP.NET_SessionId Cookie - Not Working

Question

I'm using Selenium IDE (1.3.0 on FF 7.1) to create a test case. The object of the test case is to log in to an ASP.NET application, clear the session cookie (to simulate a timeout or something similar) and then navigate to the default page the logged-in user sees, and verify that they are forwarded to the login page. Pretty simple ... but I'm just diving into Selenium IDE so I'm trying to start simple.

It seems like deleteAllVisibleCookies is the correct way to do this:

deleteAllVisibleCookies ( ) Calls deleteCookie with recurse=true on all cookies visible to the current page. As noted on the documentation for deleteCookie, recurse=true can be much slower than simply deleting the cookies using a known domain/path.

The relevant part of my Selenium IDE plan looks something like this:

assertTitle                 Project List
assertTextPresent           Start a New Project
deleteAllVisibleCookies
open                        /path/to/intro/page.aspx
assertTitle                 Log In

While running the test plan, I'm looking at the cookies set via FireCookie and Firebug.

Once the user is logged in (at the assertTextPresent part) I see two cookies - ASP.NET_SessionId and another cookie, both of which are set for the same domain (domain.local) and path (/).

When deleteAllVisibleCookies is called, I see the second cookie get deleted, but ASP.NET_SessionId does not get deleted.

I've tried adding pause 5000 after deleteAllVisibleCookies since there seems to be some indication in the documentation that the process of recursing through the cookies may be time-consuming, but that hasn't helped.

I tried using deleteAllVisibleCookiesAndWait but that just times out and fails - I'm not entirely sure from the documentation if I'm doing something wrong there, or even if that is the right call to be using in this situation.

Am I missing something here?

---

Edit: I would just use deleteCookie with the recurse option but I need this test plan to work with a variety of Base URLs so hard-coding the domain in, as I'd need to do with deleteCookie is not an option.

---

Edit 2: I can't even get the session cookie deleted by specifying the name (ASP.NET_SessionId) and domain=domain.local,recurse=true,path=/ for the arguments.

Answer 1

It isn't possible to delete the ASP.NET_SessionId cookie because it is marked HttpOnly.

Set-Cookie:ASP.NET_SessionId=zecwj145rv2wkt45ekwangyq; path=/; HttpOnly

According to this post there isn't anyway to delete or modify the cookie other than HTTP. There also isn't a way to turn off HttpOnly for this cookie.