“ASP.NET_SessionId” cookie in ASP.NET

When a user opens his web browser and makes a request to a ASP.NET Web Application for which a cookie based Session is enabled, Server generates a new SessionId and sends it to web Browser as a cookie with the name "ASP.NET_SessionId". Applications in the same DNS domain share the same Session Id and cookie. When the user browses within the same DNS domain, the browser sends same Session Id and cookie to the domain. Since it is shared across applications in a domain, so ASP.NET doesn't remove the cookie when the session is expired or Session.Abandon() is invoked. Because of this design, the code that is used to check if a Server Session is actually expired doesn't work properly. Generally we use following code snippet to check if session is expired.

if (Session.IsNewSession)
{
   if (Request.Headers("Cookie") != null && Request.Headers("Cookie").IndexOf("ASP.NET_SessionId") >= 0)
   {
        return true;
   }   
}

return false;

As ASP.NET doesn't remove the cookie "ASP.NET_SessionId" when the session is expired, so the above code doesn't check correctly. To ensure the above code works properly, the developer has to manually remove the session cookie in the event of a Session Expiry by using the following code.

Session.Abandon();
Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId") { Expires = DateTime.Now.AddDays(-1d) });