I am testing ASP.NET application, where session id (ASP.NET_SessionId) is not renewed after login. Actually it is renewed when I use browser, on the login page server sends:
Set-Cookie: ASP.NET_SessionId=; expires=Sun, 25-Jun-2017
But if I modify response for example in Burp and remove this declaration, I can log in using old cookie and this cookie will not be renew. Should this cookie be renew also in this case? Is in ASP.NET session fixation possible using only ASP.NET_SessionId? In .NET to be logged in it is necessary to have ASP.NET_SessionId, as well as .ASPXAUTH?