Question

When ever user logs into my website, I am storing HttpContext.Current.SessionID in my user log table. I want to make sure can this be duplicate? If yes, I want to make the column unique in database. If it can be duplicated, any thing to get from session which will be unique and will never be regenerated in future like GUID?

Answer 1

HttpContext.Current.SessionID will be unique for the current set of sessions only – that is, every session ID will be unique when it is active. However, once the session expires, there is no guarantee that new sessions will not have the same ID. If this is the case, any persistent data (based on a session ID) will now be referring to a different session.

Please also note the following remarks from the MSDN page.

The SessionID value is randomly generated by ASP.NET and stored in a
non-expiring session cookie in the browser. The SessionID value is
then sent in a cookie with each request to the ASP.NET application.

However, if the cookie is cleared, the session is restarted.

The SessionID is sent between the server and the browser in clear
text, either in a cookie or in the URL. As a result, an unwanted
source could gain access to the session of another user by obtaining
the SessionID value and including it in requests to the server. If you
are storing private or sensitive information in session state, it is
recommended that you use SSL to encrypt any communication between the
browser and server that includes the SessionID.