Home/ Questions/Q 1115461
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-17T03:09:30+00:00

I want to be able to log when a user ends their session on

  • 0

I want to be able to log when a user ends their session on our application and record whether it was a sign out or a the session expired. I am using 

cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));

to set a new sessionId on sign out, but when the session expires, the sessionId is reused if the browser instance is not closed. In my web.config I have used 

        <sessionState mode="InProc" timeout="1" cookieName="session" regenerateExpiredSessionId="true" />

but still get sessions reused.

I can’t kill the cookie in Session_end() because I don’t have access because there is no HttpContext or request, so I can’t reset it that way.

Does anyone have any ideas how I can force a new sessionId from the Global.asax.cs file?

Thanks

Dave

Edit – This is currently on our development environment, but our production application uses a state server for session. Not sure if this should make a difference to the sessionId Allocation (I know that I’ll need to use an custom IHttpModule rather than Session_end)

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    According to the docs on the RegenerateExpiredSessionId property:

    By default, only cookieless URLs are
    reissued when
    RegenerateExpiredSessionId is enabled

    So, unless your are using cookieless sessions, you are out of luck

    What are you doing with these session ids that you require new ones? Storing them in a db or somewhere for later lookup? If so, maybe you should look at using some other kind of id that you can control (like an identity column on sql server).

    BTW – do you really want your session to time out in one minute, or is that just a testing thing?

    • 0