Re: Cookie not expiring...

[Rogan Dawes <discard () dawes za net>]

bryan allott wrote:
> i dont think the session is actually available. maybe what is happening 
> is that a new session with the same identifier is being resurrected? 
> read the following from msdn..
>
> "Session identifiers for abandoned or expired sessions are recycled by 
> default. That is, if a request is made that includes the session 
> identifier for an expired or abandoned session, a new session is started 
> using the same session identifier. You can disable this by setting 
> regenerateExpiredSessionId attribute of the <sessionState> configuration 
> element to true. For more information, see Session Identifiers."
>
> ..NET Framework
> Supported in: 2.0, 1.1, 1.0
>
> try that?

This sounds like the application would be vulnerable to session fixation 
attacks (http://www.acros.si/papers/session_fixation.pdf) if it allows 
arbitrary session id's to be (re-)created on the fly.

Rogan