title: Generating a new SessionID on Login (ASP.NET)
body: <p>I'm trying to work a number of security issues on a rather large ASP.NET web application (C#). To prevent session fixation attacks I'd like to generate a new session id every time a user authenticates himself. However I want to only generate a new session id without losing the rest of the session. After doing some research on this topic I found a couple of working solutions:</p>
  
  <p><strong>Solution 1: <a href="https://stackoverflow.com/a/12148915/2563815">Generating new SessionId in ASP.NET</a><br /></strong>
  This suggests clearing the session cookie manually by setting it to an empty string. However this requires either a page refresh or using AJAX to ensure that the cookie will indeed be removed, which isn't really a viable option in my specific case.</p>
  
  <p><strong>Solution 2: <a href="https://stackoverflow.com/a/4420114/2563815">Generating a new ASP.NET session in the current HTTPContext</a><br /></strong>
  I have implemented this approach and it works as expected. However as the original poster states, this is not really what you might call an elegant solution. Also, this post is a few years old which has me hoping that there might be a better solution out there nowadays.</p>
  
  <p>What I would like to know is if there are any alternatives to do this that I have missed in my research or if something like Solution 2 is possible without manipulating session management internals.</p>