title: Session Fixation in ASP.NET
body: <p>I'm wondering how to prevent Session fixation attacks in ASP.NET (see <a href="http://en.wikipedia.org/wiki/Session_fixation" rel="noreferrer">http://en.wikipedia.org/wiki/Session_fixation</a>)</p>
  
  <p>My approach would to this would normally be to generate and issue a new session id whenever someone logs in. But is this level of control possible in ASP.NET land?</p>