为什么http请求Cookie:ASP.NET_SessionId登录时和注销后相同

Question

我想维护http请求Cookie：ASP.NET_SessionId

• 当用户登录到应用程序时，我可以设置Cookie：ASP.NET_SessionId
• 当用户注销时，Cookie：ASP.NET_SessionId不应与用户登录相同

目前，我在所有页面上都获得了相同的Cookie：ASP.NET_SessionId，我想在每次登录时生成Cookie：ASP.NET_SessionId。

我确实尝试过Global.asax.cs但没有任何效果。

static List<string> sessions = new List<string>();
static object sessionLock = new object();
void Application_SessionStart()
{
    lock (sessionLock) {
        sessions.Add(Session.SessionID);
    }
}
void Application_SessionEnd()
{
    lock (sessionLock) {
        sessions.Remove(Session.SessionID);
    }
}

---

if (HttpContext.Current.Response.Cookies.Count > 0)
        {
            foreach (string s in HttpContext.Current.Response.Cookies.AllKeys)
            {
                if (s == FormsAuthentication.FormsCookieName || s.ToLower() == "asp.net_sessionid")
                {
                    HttpContext.Current.Response.Cookies[s].Secure = HttpContext.Current.Request.IsSecureConnection;
                }
            }
        }

请检查附件

Answer 1

void regenerateId()
{
    System.Web.SessionState.SessionIDManager manager = new System.Web.SessionState.SessionIDManager();
    string oldId = manager.GetSessionID(Context);
    string newId = manager.CreateSessionID(Context);
    bool isAdd = false, isRedir = false;
    manager.SaveSessionID(Context, newId, out isRedir, out isAdd);
    HttpApplication ctx = (HttpApplication)HttpContext.Current.ApplicationInstance;
    HttpModuleCollection mods = ctx.Modules;
    System.Web.SessionState.SessionStateModule ssm = (SessionStateModule)mods.Get("Session");
    System.Reflection.FieldInfo[] fields = ssm.GetType().GetFields(BindingFlags.NonPublic | BindingFlags.Instance);
    SessionStateStoreProviderBase store = null;
    System.Reflection.FieldInfo rqIdField = null, rqLockIdField = null, rqStateNotFoundField = null;
    foreach (System.Reflection.FieldInfo field in fields)
    {
        if (field.Name.Equals("_store")) store = (SessionStateStoreProviderBase)field.GetValue(ssm);
        if (field.Name.Equals("_rqId")) rqIdField = field;
        if (field.Name.Equals("_rqLockId")) rqLockIdField = field;
        if (field.Name.Equals("_rqSessionStateNotFound")) rqStateNotFoundField = field;
    }
    object lockId = rqLockIdField.GetValue(ssm);
    if ((lockId != null) && (oldId !=null)) store.ReleaseItemExclusive(Context, oldId, lockId);
    rqStateNotFoundField.SetValue(ssm, true);
    rqIdField.SetValue(ssm, newId);
}