How to end a session

[Steffen Loringer]

Hi

I'm using Session.Abandon() to end a user session when clicking the
Logout button of the application. But if the user request the page
directly via URL in IE the server starts processing the page again.
The sessionIDs are the same in both cases.

I expected the sessionID not to be valid anymore.Should one end the user
session in another way? If a user is logged out he should be redirected
to the login page if he requests pages directly.

Thanks for help
Steffen

 

[John Timney \(ASP.NET MVP\)]

if the session has actually ended there is anothing to stop them being given
the same session ID as the session ID's are recycled. Check your session is
ending correctly by loading a session value in one session and checking it
in another via a different page request.

--
Regards

John Timney
ASP.NET MVP
Microsoft Regional Director

 

[Juan T. Llibre]

In ASP.NET 2.0, this is programmable via the sessionState setting:
regenerateExpiredSessionId, settable to "true" or "false"


<sessionState mode="InProc" cookieless="UseCookies" regenerateExpiredSessionId="false"
timeout="20">