ASP.NET session - How can I tell if a session is new due to expiration or initial visit?

Question

We have a page of search results which the user can hit in several ways. 90% of the ways will set up a 'Search Criteria' session object, which the results page will use to retrieve the search results.

When the session object isn't found, we will typically show the user an 'invalid search' message, and give them a link to the main search page.

The exception is the case where the user hits a webpage which has the search results page as it's default page (we use .NET's themes to provide private labels for our site, skinning it with our affiliates' colors and logos). If the search results page is the default page for the site, there is a special search that is preformed when there is no session criteria.

This is working fairly well in our testing, but there is an edge case we would like to handle: When a session expires while someone is on the search results page (having come from the search page) and they then click on the next page of results, they will get this special search instead of the 'expired session' message.

This is the basic format we're using, where searchCriteria is set from session.

if (searchCriteria == null)
{
    if (/*Check if this is the default url for this site*/)
    {
      //Preform special search
    }
    else
    {
      //Display 'session expired message'
    }
}

Is there a way we can check Session in the inner if block to see if the user's session is new due to expiration of an existing? Or do browsers just throw away the session cookies when they expire?

Is there a browser difference? Do some return the expired session cookie to the server, while other's delete them on expiration? Or is it consistent?

Answer 1

This is an excellent article which is based off of this one. I think you will find your answers here (Page 2 of the second article specifically)

Answer 2

All the browsers will return the expired session cookie. They'll do so until the browser is restarted or it's rewritten by a server response.

The answer from bnkdev uses this fact to detect new vs expired by seeing if the cookie is already set. It's simple and easy and will likely work for you, but it only works when cookies are used for session ids. It won't work for cookieless sessions.

Also, rather than hard coding "ASP.NET_SessionId", you should probably fetch it from the cookieName attribute of the sessionState configuration element.