title: How to properly handle Forms Authentication Ticket when using a Cookie-less Session
body: <p>I am pretty sure I do not have a unique problem, but I have searched all over google and this site and I haven't found a solid answer for what I am looking for. So I wanted to explain myself to see if I could get any help on this issue:</p>
  
  <p>We (my co-workers and I) determined that we need have cookie-less Sessions because our users require multiple sessions to get their work done in a more productive fashion. </p>
  
  <p><strong>Example</strong><br /> 
  Bob the user could have initiated a long running process in window A and in order to continue working Bob will open window B which spawns a new session. This is necessary in order to not disturb what is going on in window A. Every time Bob opens a new window, he has to log in again.</p>
  
  <p><strong>The Problem</strong><br />
  I am not really sure if this is a real problem or not, hence my reason for asking. The problem I <em>think</em> I have discovered is that each time Bob logs in, the current Forms Authentication Ticket (and Cookie) are over-written. Now I do not understand how this is okay or why the previous Session/Window combo is still valid after Bob logs in a second time. Since the ticket was over-written doesn't that mean the first Session/Window combo should end because the ticket is no longer valid? This is with respect to:</p>
  
  <pre><code>Request.IsAuthenticated //Making sure the supplied ticket is valid
  </code></pre>
  
  <p><strong>Questions</strong><br />
  So since the Forms Authentication Ticket (and Cookie) are being over written, what does this mean?</p>
  
  <ul>
  <li>Should I be concerned that the ticket (and Cookie) are being over written?</li>
  <li><p>During login, should I be intercepting the ticket (if any) and checking for its expiration? If it is not expired should I try to renew the ticket or just make a new one?</p>
  
  <pre><code>FormsAuthentication.RenewTicketIfOld(ticket) //Just an example
  </code></pre></li>
  <li><p>If I am using a cookie-less session should I just use cookie-less Forms Authentication too? The point of doing this would be to make each Session/Window 100% independent of each other. No over-writing would occur anymore. Is there a draw back to this? I can't think of any.</p></li>
  </ul>
  
  <p>PS: I know the cookie is just a container for what ever is being stored in it, like a Key Value pair.</p>
  
  <p>Additonal Info...</p>
  
  <p><strong>Forms Authentication Ticket:</strong><br />
  IsPersistent set to true<br />
  Ticket Version 2<br /></p>
  
  <p><strong>Forms Cookie:</strong><br />
  Key = FormsCookieName (from web.config  tag)<br />
  Value = Hashed Ticket<br /></p>
  
  <p><strong>Web.Config:</strong></p>
  
  <pre><code>&lt;sessionState 
      cookieless="true" 
      mode="SQLServer" 
      sqlConnectionString="..." 
      timeout="300" 
  regenerateExpiredSessionId="true" /&gt;
  
  &lt;forms name="FormsCookieName" 
      path="../" 
      loginUrl="Login.aspx" 
      protection="All" 
      timeout="300"
      slidingExpiration="true" &gt;
  &lt;/forms&gt;
  </code></pre>