Session fixation issue

Ramesh0809 asked:

Hello Everyone,

In one of our application we are facing below issue related SessionId.
SessionId value in cookie (Request & Response body) are not regenerating new values once user logoff from application and logins back (I mean signing off from application without closing browser and singing in back). Its maintaining earlier values, instead of generating new values.

But if close browser it's generating new values. But we wanted to generate new SessionId values every time user logoff from application and logins back.

Much appreciate your help.

What I have tried:

We tried to clear cookie values in Logout handler
Httpcontext.Current.Request.Cookies.Clear();
and Added expiration date to cookies like as
Response.Cookies["SessionID"].Expires = DateTime.Now.AddDays(-1);
But even after making these changes also we are not getting new sessionid value after logout and login.

Tags: C#, ASP, ASP.NET

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

Cancel

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

Please note that all posts will be submitted under the http://www.codeproject.com/info/cpol10.aspx.