Change ASP .NET Session Id

30 Aug 2005 6:55 AM

Jan Monsch

In order to prevent Session Fixation attacks I would like to know how it is
programatically possible to change the session id?

The idea is that after a successful authentication during login a new
session id is generated and the previous one is invalidated.

30 Aug 2005 2:32 PM

Nicole Calinoiu

Have you tried calling the HttpSessionState.Abandon method to end the
original session? (A new session will be automatically created once the old
one is dropped.)

Show quoteHide quote

"Jan Monsch" <Jan Mon***@discussions.microsoft.com> wrote in message
news:E2DCFB4F-E3DA-49D6-B344-1C87D5F479A6@microsoft.com...
> In order to prevent Session Fixation attacks I would like to know how it
> is
> programatically possible to change the session id?
>
> The idea is that after a successful authentication during login a new
> session id is generated and the previous one is invalidated.