Session Fixation in ASP.NET

Question

I\'m wondering how to prevent Session fixation attacks in ASP.NET (see http://en.wikipedia.org/wiki/Session_fixation)

My approach would to this would normally be to

Answer 1

Basically just do this in your Login GET method and your Logout method:

Session.Clear();
Session.Abandon();
Session.RemoveAll();
if (Request.Cookies["ASP.NET_SessionId"] != null)
{
   Response.Cookies["ASP.NET_SessionId"].Value = string.Empty;
   Response.Cookies["ASP.NET_SessionId"].Expires = DateTime.Now.AddMonths(-20);
}