SessionID is still the same after Session.Abandon call

user_113571 0
Viewed 27418

I'm writing some logging code that is based on SessionID...

However, when I log out (calling Session.Abandon), and log in once again, SessionID is still the same. Basically every browser on my PC has it's own session id "attached", and it won't change for some reason :/

Any ideas what is going on?

My Session config looks like this:

    <sessionState
       mode="InProc"
       timeout="1" />

Thanks, Paweł

sessionid asp.net
5 Answers

This is an old post but if someone is still looking for answers, here is a complete and step-by-step solution on how to achieve a clean logout with a new session ID every time.

Please note this article applies to cookie-enabled (cookieless=false) sites only.

Step (1) Modify your web.config file & add "regenerateExpiredSessionID" flag as under - 

<sessionState mode="InProc" cookieless="false" regenerateExpiredSessionId="true" />

Step (2) Add the following code in your logout event - 

Session.Clear(); 
Session.Abandon();
Response.Cookies.Add(New HttpCookie("ASP.NET_SessionId", ""));
Response.redirect(to you login page);

Step (3) Add the following code in your login page's page_load event - 

if(!IsPostBack) 
{
    Session.Clear(); 
    Session.Abandon();
}

Step 2 and 3 serve one IMPORTANT purpose. This code makes sure a brand new Session ID is generated after you click the "Login" button. This prevents Weak Session Management (Session Fixation vulnerability) which will likely be spotted during a 3rd party Penetration Testing of your site.

Hope this helps.

user_55112740
Related