Session fixation issue

Question

0.00/5 (No votes)

See more:

Hello Everyone,

In one of our application we are facing below issue related SessionId.
SessionId value in cookie (Request & Response body) are not regenerating new values once user logoff from application and logins back (I mean signing off from application without closing browser and singing in back). Its maintaining earlier values, instead of generating new values.

But if close browser it's generating new values. But we wanted to generate new SessionId values every time user logoff from application and logins back.

Much appreciate your help.

What I have tried:

We tried to clear cookie values in Logout handler
Httpcontext.Current.Request.Cookies.Clear();
and Added expiration date to cookies like as
Response.Cookies["SessionID"].Expires = DateTime.Now.AddDays(-1);
But even after making these changes also we are not getting new sessionid value after logout and login.

Posted 7-Sep-19 19:23pm

Ramesh0809

Updated 8-Sep-19 3:13am

v2

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

MadMyche · Answer 1 · 2019-09-08T03:14:00

Solution 1

You should work with the Session object itself for this scenario.

Session.Clear() will clear all values attached to the current session. So if you are using Session to store a bunch of things related to User Login and such this remove them all. The SessionID will remain the same.

Session.Abandon() will kill the user session and also trigger the Session_End event. The Next request should also have a new SessionID

Posted 8-Sep-19 3:14am

MadMyche

Comments

Ramesh0809 10-Sep-19 10:50am

Thanks you MadMyche. Actually our application is vast application (it has C++, classic asp and modern asp). I tried by clearing and Abandoned session. But some where in pipeline it's injecting same values again (I think because of classic asp but not sure).
But getting same ASP.NET_SessionId on re-login.

MadMyche 10-Sep-19 12:30pm

Classic ASP and ASP.Net are completely separate applications and each will have it's own Session- the process to clear/abandon would need to be done within both applications