title: Is there any good reason why the authentication cookie and the session state cookie are two separate cookies?
body: <p>Is there any good reason why ASP.NET's session state cookie and the Forms Authentication cookie are two separate cookies? What if I want to "tie" them to each other? Is it possible in an elegant way?</p>
  
  <p>Right now, I am stuck with the following solution, which works, but is still ugly:</p>
  
  <pre><code>[Authorize]
  public ActionResult SomeAction(SomeModel model)
  {
      // The following four lines must be included in *every* controller action
      // that requires the user to be authenticated, defeating the purpose of
      // having the Authorize attribute.
      if (SomeStaticClass.WasSessionStateLost/*?*/) {
          FormsAuthentication.SignOut();
          return RedirectToAction("Login", "Account");
      }
  
      // ...
  }
  </code></pre>
  
  <hr>
  
  <p><strong>@RPM1984:</strong> This is what happens:</p>
  
  <pre><code>[HttpPost]
  public ActionResult Login(LoginModel loginModel)
  {
      if (/* user ok */)
      {
          // ...
          Session["UserID"] = loginModel.UserID;
          Session["Password"] = loginModel.Password;
          // ...
      }
      else
      {
          return View();
      }
  }
  </code></pre>
  
  <p>And it doesn't take much guessing to know what <code>WasSessionStateLost</code> does.</p>