title: Generating a new ASP.NET session in the current HTTPContext
body: <p>As a result of a penetration test against some of our products in the pipeline, what looked to be at the time an 'easy' problem to fix is turning out to be a toughy. </p>
  
  <p>Not that it should of course, I mean why would just <strong>generating a brand new session for the current <code>HTTPContext</code></strong> be so difficult? Bizarre! Anyway- I've written a cheeky little utility class to "just do it": </p>
  
  <p>(apologies for code formatting/highlighting/Visual Basic I <em>must</em> be doing something wrong)</p>
  
  <pre><code>
  Imports System.Web
  Imports System.Web.SessionState
  
  Public Class SwitchSession
  
      Public Shared Sub SetNewSession(ByVal context As HttpContext)
          ' This value will hold the ID managers action to creating a response cookie
          Dim cookieAdded As Boolean
          ' We use the current session state as a template
          Dim state As HttpSessionState = context.Session
          ' We use the default ID manager to generate a new session id
          Dim idManager As New SessionIDManager()
          ' We also start with a new, fresh blank state item collection
          Dim items As New SessionStateItemCollection()
          ' Static objects are extracted from the current session context
          Dim staticObjects As HttpStaticObjectsCollection = _
              SessionStateUtility.GetSessionStaticObjects(context)
          ' We construct the replacement session for the current, some parameters are new, others are taken from previous session
          Dim replacement As New HttpSessionStateContainer( _
                   idManager.CreateSessionID(context), _
                   items, _
                   staticObjects, _
                   state.Timeout, _
                   True, _
                   state.CookieMode, _
                   state.Mode, _
                   state.IsReadOnly)
          ' Finally we strip the current session state from the current context
          SessionStateUtility.RemoveHttpSessionStateFromContext(context)
          ' Then we replace the assign the active session state using the replacement we just constructed
          SessionStateUtility.AddHttpSessionStateToContext(context, replacement)
          ' Make sure we clean out the responses of any other inteferring cookies
          idManager.RemoveSessionID(context)
          ' Save our new cookie session identifier to the response
          idManager.SaveSessionID(context, replacement.SessionID, False, cookieAdded)
      End Sub
  
  End Class
  </code></pre>
  
  <p>It works fine for the remainder of the request, and correctly identifies itself as the new session (e.g. <code>HTTPContext.Current.Session.SessionID</code> returns the newly generated session identifier). </p>
  
  <p>Surprise surprise then, that when the next request hits the server, the <code>HTTPContext.Session</code> (an <code>HTTPSessionState</code> object) identifies itself with the correct <code>SessionID</code>, but has <code>IsNewSession</code> set to <code>True</code>, and is empty, losing all the session values set in the previous request.</p>
  
  <p>So there must be something special about the previous <code>HTTPSessionState</code> object being removed from the initial request, an event handler here, a callback there, something which handles persisting the session data across requests, or just something I'm missing?</p>
  
  <p>Anybody got any magic to share?</p>