Report viewer control Export function exposes session id with ASP.NET Web Forms

the file export function report viewer control uses session id in url, heightlighted below:

http://domaim/reserved.reportviewerwebcontrol.axd?reportsession=sessionidxxxxxxxxx&culture=2057&cultureoverrides=true&uiculture=2057&uicultureoverrides=true&reportstack=1&controlid=2c3de8dad69842d7bed6bd7b755784bb&optype=export&filename=filenametoexport&contentdisposition=onlyhtmlinline&format=csv

user clicks export -> required file format -> file downloaded -> link above file downloaded.

please see image below

http://s23.postimg.org/8yb71b7dn/untitled.png

i want find out if session id expose security risk. if so, if possible remove session id url, or more secure way allow download.

please note reporting services client side sends requrest web forms reporting services.

thanks in advance.

hi kingofwebguru,

as per understanding, sessionid specifies established active report session between client application , report server. value of parameter set session identifier. can specify session id part of url have down.

or can specify session id cookie. when report server has been configured not use session cookies, first request without specified session id results in redirection session id.

for more information report server sessions, please see following document:
identifying execution state

hope helps.

thanks,
katherine xiong

---

katherine xiong
technet community support

SQL Server  >  SQL Server Reporting Services, Power View