I am testing ASP.NET application, where session id (ASP.NET_SessionId) is not renewed after login. Actually it is renewed when I use browser, on the login page server sends:

Set-Cookie: ASP.NET_SessionId=; expires=Sun, 25-Jun-2017

But if I modify response for example in Burp and remove this declaration, I can log in using old cookie and this cookie will not be renew. Should this cookie be renew also in this case? Is in ASP.NET session fixation possible using only ASP.NET_SessionId? In .NET to be logged in it is necessary to have ASP.NET_SessionId, as well as .ASPXAUTH?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.