ASP.NET MVC - Forms Authentication / Session ID

Question

I am wondering how the Session ID works in Forms Authentication? Becuase I did a Response.Write(Session.SessionID); on my home controller and then logged out. I then logged in as a new User and the Session ID was the same. Below are my LogOn and LogOff Actions:

LogOn:

[HttpPost]
        public ActionResult LogOn(LogOnModel model, string returnUrl)
        {
            try
            {
                if (ModelState.IsValid)
                {
                        if (Membership.ValidateUser(model.UserName, model.Password))
                        {
                            FormsAuthentication.SetAuthCookie(model.UserName, model.RememberMe);

                            if (Url.IsLocalUrl(returnUrl) && returnUrl.Length > 1 && returnUrl.StartsWith("/")
                                && !returnUrl.StartsWith("//") && !returnUrl.StartsWith("/\\"))
                            {
                                return Redirect(returnUrl);
                            }
                            else
                            {
                                return RedirectToAction("Index", "Home");
                            }
                        }
                    else
                    {
                        ModelState.AddModelError("", "The user name or password provided is incorrect.");
                    }
                }

                // If we got this far, something failed, redisplay form
                return View("LogonError", model);
            }
        catch (Exception ex)
        {
            string test = ex.Message;
            return PartialView("_Error", test);
        }
    }

LogOff:

    public ActionResult LogOff()
    {
        FormsAuthentication.SignOut();

        return RedirectToAction("Index", "Home");
    }

There are 2 different cookies for authentication and session. — Believe2014
– Believe2014, Commented Jun 2, 2014 at 2:41

MikeSW · Accepted Answer · 2012-02-15 11:38:27Z

4

Session has its own cookie, different from the Forms Authentication cookie

answered Feb 15, 2012 at 11:38

MikeSW

16.4k3 gold badges42 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

CallumVass Over a year ago

Forgive me but Im new to Forms Authentication. How would I then resolve this as I'm creating a basket linked to a Session ID so if 2 user's have the same Session ID then they'll see each others items?

MikeSW Over a year ago

The only way to hijach another session is to have the actually cookie. However when you loggout the user you can call Session.Abandon() which should destroy the current session.

CallumVass Over a year ago

I've just tried this whilst using intellisense and found the Abandon method but it still output the same Session ID

MikeSW Over a year ago

Quote from MSDN: Session identifiers for abandoned or expired sessions are recycled by default. That is, if a request is made that includes the session identifier for an expired or abandoned session, a new session is started using the same session identifier. You can disable this by setting regenerateExpiredSessionId attribute of the sessionState configuration element to true. For more information, see Session Identifiers.

CallumVass Over a year ago

Solved it: I added Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", "")); to my logoff action, this gives a new ID each time

|

Collectives™ on Stack Overflow

ASP.NET MVC - Forms Authentication / Session ID

1 Answer 1

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related