title: Invalid session cookie is not invalidated or replaced?
body: <p>In ASP.NET i was having a strange situation where <code>Session_Start</code> was being triggered every time the user-agent refreshed the page. Since a session should have already been started, i couldn't understand why (this one machine) was triggering a <code>Session_Start</code> every page hit.</p>
  
  <p>The browser was sending a cookie as part of the HTTP request:</p>
  
  <pre><code>GET http://example.com/ HTTP/1.1
  Accept: text/html, application/xhtml+xml, */*
  Accept-Language: en-US
  Accept-Encoding: gzip, deflate
  ...
  Cookie: ASP.NET_SessionId=zsdntozy30cwvirc3lpnxh55
  </code></pre>
  
  <p>The cookie was present in the http <strong>request</strong> header, yet it was causing a new session to be created. Maddeningly though, the new <code>Cookie</code> was not being sent to the client (through the <code>Set-Cookie</code> response header).</p>
  
  <p>i <em>assume</em> that if the session cookie <code>ASP.NET_SessionId=zsdntozy30cwvirc3lpnxh55</code> is not valid (e.g. due to an application pool recycle, or web-server restart) then the server <em>should</em> <code>set</code> a new cookie.</p>
  
  <p>To test this i crafted a special http request, with an obviously invalid cookie:</p>
  
  <pre><code>GET http://example.com/ HTTP/1.1
  Accept: text/html, application/xhtml+xml, */*
  Accept-Language: en-US
  Accept-Encoding: gzip, deflate
  ...
  Cookie: ASP.NET_SessionId=aaaaaaaaaaaaaaaaaaaaaaaa
  </code></pre>
  
  <p>Sure enough, the <code>Session_Start</code> event happens, and the http <strong>response</strong> contains no <code>Set-Cookie</code> header:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: ASP.NET Development Server/10.0.0.0
  Date: Thu, 24 Mar 2011 23:45:50 GMT
  X-AspNet-Version: 2.0.50727
  Cache-Control: private
  Content-Type: text/html; charset=utf-8
  Content-Length: 3710
  Connection: Close
  </code></pre>
  
  <p>Is this intended behavior? If the client's session cookie is no longer valid, they'll be stuck in some no-mans land until the client browser is convinced to destroy the cookie?</p>
  
  <p>Is there an option for ASP.NET to sent the <strong>new</strong> session cookie to the client? It is, after all, <strong>creating</strong> a new session - why not tell the client about it?</p>
  
  <p>Is this some bizarre security feature, where a user must delete all cookies if a server gets the hiccups?</p>