=== on 19 Jan 2021, 09:27:32 Costin Zaharia wrote:
As far as I can tell, this rule does not apply for Asp.Net. According to documentation: "The SessionID value is randomly generated by ASP.NET and stored in a non-expiring session cookie in the browser." Source: https://docs.microsoft.com/en-us/dotnet/api/system.web.sessionstate.httpsessionstate.sessionid?view=netframework-4.8#System_Web_SessionState_HttpSessionState_SessionID[HttpSessionState.SessionID Property]


This property is read-only (does not have a setter) and the class is sealed so this behavior cannot be easily changed.


For Asp.Net Core the behavior is similar. An implementation of https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.isession.id?view=aspnetcore-5.0#Microsoft_AspNetCore_Http_ISession_Id[ISession] is provided by the framework and the *Id* is read-only.



