SessionID is still the same after Session.Abandon call

Question

Hi,

I'm writing some logging code that is based on SessionID...

However, when I log out (calling Session.Abandon), and log in once again, SessionID is still the same. Basically every browser on my PC has it's own session id "attached", and it won't change for some reason :/

Any ideas what is going on?

My Session config looks like this:

    <sessionState
       mode="InProc"
       timeout="1" />

Thanks, Paweł

Answer 1

This is a default behavior by design as stated here:

Session identifiers for abandoned or expired sessions are recycled by default. That is, if a request is made that includes the session identifier for an expired or abandoned session, a new session is started using the same session identifier. You can disable this by setting regenerateExpiredSessionId attribute of the sessionState configuration element to true

You can disable this setting as mentioned above.

EDIT: Setting regenerateExpiredSessionId attribute to true works only for cookieless sessions. To overcome your problem, you can consider to implement a custom class that inherits SessionIDManager class. You can get information about that here and here.

Answer 2

You may explicitly clear the session cookie. You should control the cookie name by configuration and use same name while clearing.

Edit: Clearing session cookie when session is abandoned will force ASP.NET to create new session & sessionid for next request. BTW, yet another way to clear the session cookie is to use SessionIDManager.RemoveSessionID method.

Answer 3

Check this article which explains the process on session.abandon

http://support.microsoft.com/kb/899918

Taken from above link -

"When you abandon a session, the session ID cookie is not removed from the browser of the user. Therefore, as soon as the session has been abandoned, any new requests to the same application will use the same session ID but will have a new session state instance"