Why is ASP.NET accepting externally created session identifiers?

This isn't a vulnerability (and I really don't like AppScan because of its false positives - the number of times I've had to explain CSRF cookies need not be linked to a session on my little open source project is getting annoying).

All that will happen in this case is the first time anything is stored in session state with a created session identifier a new session will be opened on the server, with nothing in it. If you're worried about session fixation then you can clear the cookie after authentication.

Session.Abandon();
Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));

But with forms authentication the authentication details are not held in the session and so fixation is not a problem at all.

Frankly if you must pass security scans without anyone evaluating if the results are not false positives then that's a whole different problem.

You might need to change the default cookie settings to be unique to you app

Try setting a unique cookie path:

<forms name="YourAppName"
       path="/FormsAuth" ... />

http://msdn.microsoft.com/en-us/library/ms998310.aspx#paght000012_additionalconsiderations

More reading... http://msdn.microsoft.com/en-us/library/ms998258.aspx

Bobby, Have you had any luck? I too am dealing with the same issue from AppScan. A coworker of mine passed by explicitly resetting the session id for each successful login, but have had no such luck myself.

protected void Login1_LoggedIn(object sender, EventArgs e) { Session.Abandon(); Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", "")); }

The peculiar part is the AppScan request is redirecting to my error page (that I have specified in AppScan) but is still flagging me.

Thanks in advance, Mark

It would seem RegenerateExpiredSessionId property is controlling this. Do set it to true. Also keep time-out to a and low value, the tightest acceptable by users (e.g. 10 - 15 minutes).