title: Update session cookies after authentication
body: <p>We have two factor authentication in place to login into our system. </p>
  
  <ol>
  <li>User has to login using username/password.</li>
  <li>In the next page, user has to answer security questions to successfully login into our application.</li>
  </ol>
  
  <p>We are creating multiple sessions upon user successfully authenticated in step #1. This session information will be used across the application.</p>
  
  <p>I have used below peace of code to handle session fixation issue:
    When user browse the application login page, I am deleting the sessionid in the session-cookie using below code in the page load.</p>
  
  <pre><code>if(!IsPostBack)
  {
              HttpContext.Current.Session.Clear();
              HttpContext.Current.Session.Abandon();
              HttpContext.Current.Session.RemoveAll();
              Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));
  }
  </code></pre>
  
  <p>The above code will empty the sessionid in the session cookie. Now when user enter the appropriate credentials asp.net will create new session id automatically, so browser will get new session upon successful authentication. If user entered wrong credentials then using above code i am resetting the sessionid again so the new sessionid will automatically generated up on successful authentication.</p>
  
  <p>This approach worked fine for single factor authentication and session fixation was no more a defect in security reports. But with multi factor authentication still it is an issue. I couldn't use above code to reset the cookie sessioid in the page where i am verifying the security answers as the application loosing all the session variables created in step #1.</p>
  
  <p>As a work around in #2, after answering security questions successfully I have tried to save session values in the temporary object and reset the sessioid in the cookie and reassigning the object to session variables again, but sessionid is not regenerating at this point of time so i coudln't re save the session and application started throwing the exceptions wherever those session variables being accessed.</p>
  
  <p>Below is the event triggered up on successful authentication in step #2 page</p>
  
  <pre><code>private void Sucess()
  {
         login = Session.logininfo           
         HttpContext.Current.Session.Abandon();
         HttpContext.Current.Session.RemoveAll();
         Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));
         Session.logininfo = login;     
          Response.Redirect("New.aspx", true);
  }
  </code></pre>
  
  <p>May i know is there any better way to update the session cookies in this case.</p>