ending users asp.net session

Question

Can I end some users session in ASP.NET Webform application, if I have user's the SessionId? I would do this as a web service call.

Answer 1

The line:-

HttpContext.Current.Sesssion.Abandon();

will end the users session. You would need to do this by injecting the correct ASP.NET session cookie in the request if you are not calling this from the client that is already using the session.

Answer 2

If you wish to terminate a user's session then you can call a page-method via ajax that calls Session.abandon() and upon completion of the call redirect the user to login page.

Answer 3

You have potentially three options.

1. If you are using a SQL Server database to house your session state, you can easily navigate through that and delete the row specific tot hat user. Thus clearing their session.
2. Add code to your base page to check a file or database to see if that users session should be cleared.
3. Since you know the users session id, you may be able to visit the site yourself and then hack your ASP.Net Session cookie to have your session id be the same. Then you'd have to visit a page that calls the Sesssion.Abandon(); call. Though I am not sure if security limitations on the .NET side would allow this.