Generating new SessionId in ASP.NET

Question

On login I want to generate a new SessionId. I have found one solution that works, but it requires some pretty hackish things and requires the app have Full Trust securityPolicy setting.

Is there any other way to achieve this?

Answer 1

Looks like this works:

Session.Abandon();
Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));

By clearing out that cookie, a new session with a new session ID will be created at the server.

(Reference: Microsoft Support)

EDIT: Here's an example using AJAX (with jQuery) to call the server code without a page refresh - it calls twice, once to remove the first session, and once to generate a new one. There may be a better way, but this does work.

function newSession() {
    jQuery.ajax({
        type: "POST",
        url: "WebForm1.aspx/ClearSession",
        data: "{}",
        dataType: "json",
        contentType: "application/json; charset=utf-8",
        success: function () {
            jQuery.ajax({
                type: "POST",
                url: "WebForm1.aspx/NewSession",
                data: "{}",
                dataType: "json",
                contentType: "application/json; charset=utf-8",
                success: function () { console.log("Success!"); },
                error: function (x, y, z) {
                    console.log("Failure!");
                }
            });
        },
        error: function (x, y, z) {
            console.log("Failure!");
        }
    });
}

And on the code-behind (for WebForms - you could also do this with an MVC controller):

[WebMethod]
public static void ClearSession()
{
    HttpContext.Current.Session.Abandon();
    HttpContext.Current.Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));
}

[WebMethod]
public static void NewSession()
{
    HttpContext.Current.Session["x"] = 123;
}