In my classic ASP application, the ASP session ID related cookie gets lost when the client closes his browser, Even thought the session didn't timeout. So...
How to make ASP session ID cookie to remain the same even if the clients closes his browser?
You can increase the session time out.
Session.Timeout[=nMinutes]
http://www.asp101.com/articles/john/sessionsend/default.asp
<%
Response.Cookies("firstname")="Alex"
Response.Cookies("firstname").Expires=#May 10,2012#
%>
Wont this work??
When you start a new browser session and browse to your site, classic ASP will detect that there is no ASP session cookie and will create a new session for you (as you have already experienced).
Session cookies are just that, they exist for the lifetime of the session. When you close your browser the session cookie will be deleted (even though your session state on the server will live on as an orphaned session until Session.Timeout expires - unless you present the same session cookie again within the Session.Timeout period).
The only way to extend the lifetime of the ASP session cookie across new browser sessions/instances would be to alter the cookie lifetime using script on the browser/client.
If you're looking to manage state across events such as the browser closing, you'll need implement your own state management mechanism (persist state to a database for example) and use a regular cookie with a long lifetime (or with a sliding expiration where you extend the lifetime by a small amount of time on each request in your server side script) to match state to the user.
Edit:
The following article has a script to modify the session cookie (scroll down to Cookie Expiration):
But as Shoban correctly points out there is a risk of Session Fixation (OWASP). You can however go some way to protect yourself against this:
I'd also add some caveats, if your application is storing sensitive data (credit cards, financials, medical etc) then I'd suggest not doing this and live with the fact that your user will have to logon again and start a new session. Better safe than sorry.
You need to persist the session cookie as, for security reasons, you can't access the session between browsers (be it two different browsers, or the same one closed and re-opened).
Normally, you would store the details server side and use a client side cookie that contains a simple id to retrieve the information.
"Session cookie" is the clue: when the user closes their browser they are ending their session.
The server timeout exists because the server has no way of knowing that the user ended the session, so it works on the basis that if they don't come back for a while, the session must be over.
If you want a persistent cookie, you'll have to set it yourself; but there's no way of preventing the user from ending their session.