Session gets null in ASP.NET
<p>My application has a <em>Session Fixation Vulnerability</em>. To fix that vulnerability, I am changing the session id after login. </p>

<p>I am having below web pages in different folders Master and Transaction.</p>

<p><code>~/Master/Login.aspx</code> : After the credentials validated, I am setting </p>

<pre><code>Response.Cookies["ASPFIXATION"].Value ="xyz";
Session["ASPFIXATION"] = "xyz"
</code></pre>

<p>and redirect to ~/Master/Home.aspx</p>

<p><code>~/Master/Home.aspx</code> : In this page, I am checking the session value with the cookie value on page load event.  </p>

<pre><code>string cookie_value = string.Empty;
string session_value = string.Empty;
if (Request.Cookies["ASPFIXATION"] != null)
    cookie_value = Request.Cookies["ASPFIXATION"].Value;
if (HttpContext.Current.Session["ASPFIXATION"] != null)
    session_value = HttpContext.Current.Session["ASPFIXATION"].ToString();
if (cookie_value != g_SessionFix)
{
    if (Request.Cookies["ASP.NET_SessionId"] != null)
    {
        Response.Cookies["ASP.NET_SessionId"].Value = null;
        Response.Cookies["ASP.NET_SessionId"].Expires = DateTime.Now.AddDays(-1);
    }
    if (Request.Cookies["ASPFIXATION"] != null)
    {
        Response.Cookies["ASPFIXATION"].Value = null;
        Response.Cookies["ASPFIXATION"].Expires = DateTime.Now.AddDays(-1);
    }
    Response.Redirect("~/Master/Login.aspx", false);
}
</code></pre>

<p>Here the Session has the value and it is validated.</p>

<p><code>~/Transaction/Report.aspx</code> : If i redirect to this page and have to check the same session and cookie value logic in this page load. But here the value of <code>HttpContext.Current.Session["ASPFIXATION"]</code> is <code>null</code> and value of <code>HttpContext.Current.Session.IsNewSession</code> also <code>true</code></p>