Difference with regenerateExpiredSessionId="false" and regenerateExpiredSessionId="true" .net

Question

My understanding from

http://msdn.microsoft.com/en-us/library/system.web.configuration.sessionstatesection.regenerateexpiredsessionid.aspx

meaning of regenerateExpiredSessionId="false" was that if a session id expired it will NOT be re used if client requests an url with same id.

And mening of regenerateExpiredSessionId="true" was that if a session id expired it will be re-used (recycled) if client request an url with same id.

But when i read post at

regenerateExpiredSessionId not working as expected

it seems that i misunderstood what regenerateExpiredSessionId="true" means.

Can some one explain which is right?

Needful

I believe you are correct and I don't see how the other post contradicts this. – Guileless

I know this question is 5 years old, but I'd still love to see a clarifying answer that confirms or denies the above interpretation of this setting. I find it a little confusing too. – Essary

Answer 1

By default, the session ID values that are used in cookieless sessions are recycled. That is, if a request is made with a session ID that has expired, a new session is started by using the SessionID value that is supplied with the request. This can result in a session unintentionally being shared when a link that contains a cookieless SessionID value is used by multiple browsers. (This can occur if the link is passed through a search engine, through an e-mail message, or through another program.) You can reduce the chance of session data being shared by configuring the application not to recycle session identifiers. To do this, set the regenerateExpiredSessionId attribute of the sessionState configuration element to true. This generates a new session ID when a cookieless session request is made with an expired session ID.

Ref: http://msdn.microsoft.com/en-us/library/ms178581.aspx

Frictional

Answer 2

I believe that the word "reissue" is problematic when people discuss this attribute. I have seen some posts interpret it to mean "a new session id is generated and issued to the client," and others which interpret it to mean "an expired session id is assigned to a new session and issued to the client." I believe that the msdn documentation means it in the latter sense, and that the stack overflow post you reference incorrectly interpreted it as the former.

Aidaaidan