asp.net-session

UPDATE We eventually had a meeting with some programmers on the Acunetix team and they realized there may be a few bugs in their code that are causing this to be displayed in the scan as more of an issue than it actually may be. The general consensus was to ignore the scan results and use the out-of-the-box ASP.NET Session ID generation as it should be secure enough for our site. @Vasile Bujac since your answer was the only one and mentioned using the ASP.NET standard solution I took that as the answer, but thanks everyone for your help. We use Acunetix's Retina scanner at work to do security

What is the difference between destroying a session and removing its values? Can you please provide an example demonstrating this? I searched for this question, but don't grasp total answer. Some answers are: Session.Abandon() destroys the session Session.Clear() just removes all values A friend told me this: Clearing the session will not unset the session, it still exists with the same ID for the user but with the values simply cleared. Abandon will destroy the session completely, meaning that you need to begin a new session before you can store any more values in the session for that user.