How to Kill A Session or Session ID (ASP.NET/C#)

Question

How can I destroy a session (Session["Name"]) when the user clicks the logout button?

I'm looking through the ASP.NET API Reference on MSDN and it doesn't seem to have much information. It seems rather limited. But I cannot find any other pages for ASP.NET Classes etc.

I have tried:

Session.Abandon(); and Session.Contents.Remove("Name"); neither of them work. ( I found these in a forum from a Google search)

Ca

What do you mean by "neither of them work" – Benedictine

Um... When I output the contents of the session["Name"] it still outputs the name, but it shouldn't because it should've been cleared or killed. And it doesn't Sign me out. So, that's what I mean by "Neither of them work" – Ca

Try adding a redirect back to the login page, check for the Session["Name"] in there. – Benedictine

May be this link might help you. – Knossos

The Abaondon Method works all you need to do is take of the postbackurl from the html script and add a redirect after Session.Abandon(). – Alary

Use Session["YourItem"] = ""; – Rozanne

Answer 1

The Abandon method should work (MSDN):

Session.Abandon();

If you want to remove a specific item from the session use (MSDN):

Session.Remove("YourItem");

EDIT: If you just want to clear a value you can do:

Session["YourItem"] = null;

If you want to clear all keys do:

Session.Clear();

If none of these are working for you then something fishy is going on. I would check to see where you are assigning the value and verify that it is not getting reassigned after you clear the value.

Simple check do:

Session["YourKey"] = "Test";  // creates the key
Session.Remove("YourKey");    // removes the key
bool gone = (Session["YourKey"] == null);   // tests that the remove worked

Bonedry

Thanks, @Kelsey; I just updated my question to show what I've already tried. The Abaondon Method doesn't work :S – Ca

@Lucifer are you trying to kill the Session from the current session or are you trying to do it from the application level and locate and kill a specific session? – Bonedry

Um, from the current session,? – Ca

@Lucifer something else is going on I suspect. I have editted my answer to include a little check and some other options. – Bonedry

Thanks @Kelsey, I'm not seeing any results from that check. – Ca

@Lucifer What result were you expecting? The value will be null after the Remove. Did you want something more to happen? – Bonedry

Answer 2

It is also a good idea to instruct the client browser to clear session id cookie value.

Session.Clear();
Session.Abandon();
Response.Cookies["ASP.NET_SessionId"].Value = string.Empty;
Response.Cookies["ASP.NET_SessionId"].Expires = DateTime.Now.AddMonths(-10);

Loosestrife

is this really necessary ? Response.Cookies["ASP.NET_SessionId"].Value = string.empty ? or just with Session.Abandon() is enough ? – Danonorwegian

Answer 3

Session.Abandon()

This marks the session as Abandoned, but the session won't actually be Abandoned at that moment, the request has to complete first.

Benedictine

Answer 4

From what I tested:

Session.Abandon(); // Does nothing
Session.Clear();   // Removes the data contained in the session

Example:
001: Session["test"] = "test";
002: Session.Abandon();
003: Print(Session["test"]); // Outputs: "test"

Session.Abandon does only set a boolean flag in the session-object to true. The calling web-server may react to that or not, but there is NO immediate action caused by ASP. (I checked that myself with the .net-Reflector)

In fact, you can continue working with the old session, by hitting the browser's back button once, and continue browsing across the website normally.

So, to conclude this: Use Session.Clear() and save frustration.

Remark: I've tested this behaviour on the ASP.net development server. The actual IIS may behave differently.

Alguire

Answer 5

Session.Abandon() this will destroy the data.

Note, this won't necessarily truly remove the session token from a user, and that same session token at a later point might get picked up and created as a new session with the same id because it's deemed to be fair game to be used.

Som

Thanks @Chris, I've tried that, and it still outputs the contents of the session["Name"] and won't signout. – Ca

Answer 6

You kill a session like this:

Session.Abandon()

If, however, you just want to empty the session, use:

Session.Clear()

Chalkboard

If you're just trying to remove the 'Name', you can do Session.Remove("Name"); or clear it using Session["Name"] = null; – Chalkboard

None of these are working. I've tried Session.Abandon(); Session.Contents.Remove("Name"); Session.Contents.RemoveAll(); Session.Clear(); Session["Name"] = null (which is originally what I did) - and none of them work. – Ca

Answer 7

Session.Abandon()

is what you should use. the thing is behind the scenes asp.net will destroy the session but immediately give the user a brand new session on the next page request. So if you're checking to see if the session is gone right after calling abandon it will look like it didn't work.

Nicol

Check the Remarks section on the MSDN doc for Session.Abandon -> msdn.microsoft.com/en-us/library/ms524310.aspx – Nicol

Thank you @AlanB - Then, how can I Sign out of my 'account' immediately after clicking the SignOut button?, if the session won't get deleted? – Ca

I guess it depends a bit on the code you're doing but the basic operation would be if you have "Logout" button on a page that in the code does a session.abandon() call then redirects to your homepage. the loading of the homepage should have a new session and thus not be "logged in" anymore. they will have a new session but all data associated with the old session is gone. – Nicol

Answer 8

Session["YourItem"] = "";

Works great in .net razor web pages.

Rozanne

While this code sample may possibly answer the question, it would be preferable to include some essential explanation to your answer. As it stands now this answer adds little to no value for future readers. – Kerge

Answer 9

Session.Abandon(); did not work for me either.

The way I had to write it to get it to work was like this. Might work for you too.

HttpContext.Current.Session.Abandon();

Refit