title: Session Fixation in ASP.Net MVC
body: <p>Is it possible to block an action to be executed directly from the browser, but still be able to redirect to it from inside the site? I know it sounds stupid but this is what I want:</p>
  
  <p>Let's say there are two routes, <code>Index</code> and <code>Index2</code> of <code>HomeController</code>.</p>
  
  <p><code>www.website.com/home</code> will cause Index to be executed, I then want to execute some code and then redirect (or server transfer) to <code>www.website.com/home/index2</code>.</p>
  
  <p>I don't want the URL <code>www.website.com/home/index2</code> to be accessed directly by the user, without going to <code>home/index</code> first.</p>
  
  <p>Is there something I can do to deactivate/activate the route at runtime?</p>
  
  <p>EDIT: Sorry, this question is titled "Session Fixation" because I need <code>Index</code> to run prior to <code>Index2</code> to ensure we are killing all Sessions in <code>Index</code> and renewing them before <code>Index2</code> executes.</p>
  
  <p>I cannot kill the session and execute the code in <code>Index2</code> in the same request since <code>Index2</code> needs session to do its job.</p>