Remove (Delete) ASP.NET_SessionId Cookie from browser after Logout using C# in ASP.Net

Hi jovceka,

Refer the below code. I have checked with Global.asax the cookie is removed. You can see the brower Request Header.

HTML

<fieldset>
    <legend>Login</legend>
    <p>
        Username : <asp:TextBox ID="txtU" runat="server" />
    </p>
    <p>
        Password : <asp:TextBox ID="txtP" runat="server" />
    </p>
    <p>
        <asp:Button ID="btnSubmit" runat="server" Text="Login" OnClick="LoginMe" />
        <asp:Label ID="lblMessage" runat="server" EnableViewState="false" />
        <asp:Button ID="btnLogout" runat="server" Text="Logout" OnClick="LogoutMe" Visible="false" />
    </p>
</fieldset>

Code

protected void Page_Load(object sender, EventArgs e)
{
    if (Session["LoggedIn"] != null && Session["AuthToken"] != null && Request.Cookies["AuthToken"] != null)
    {
        if (!Session["AuthToken"].ToString().Equals(Request.Cookies["AuthToken"].Value))
        {
            // redirect to the login page in real application
            lblMessage.Text = "You are not logged in.";
        }
        else
        {
            lblMessage.Text = "Congratulations !, you are logged in.";
            lblMessage.ForeColor = System.Drawing.Color.Green;
            btnLogout.Visible = true;
        }
    }
    else
    {
        lblMessage.Text = "You are not logged in.";
        lblMessage.ForeColor = System.Drawing.Color.Red;
    }
}

protected void LoginMe(object sender, EventArgs e)
{
    lblMessage.Text = "";
    if (txtU.Text.Trim().Equals("u") && txtP.Text.Trim().Equals("p"))
    {
        Session["LoggedIn"] = txtU.Text.Trim();
        // createa a new GUID and save into the session
        string guid = Guid.NewGuid().ToString();
        Session["AuthToken"] = guid;
        // now create a new cookie with this guid value
        Response.Cookies.Add(new HttpCookie("AuthToken", guid));
        Response.Redirect(Request.Url.AbsoluteUri);
    }
    else
    {
        lblMessage.Text = "Wrong username or password";
    }
}

protected void LogoutMe(object sender, EventArgs e)
{
    Session.Clear();
    Session.Abandon();
    Session.RemoveAll();
    if (Request.Cookies["ASP.NET_SessionId"] != null)
    {
        Response.Cookies["ASP.NET_SessionId"].Expires = DateTime.Now.AddDays(-1);
        Response.Cookies["ASP.NET_SessionId"].Value = string.Empty;
        Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", string.Empty));
    }
    if (Request.Cookies["AuthToken"] != null)
    {
        Response.Cookies["AuthToken"].Value = string.Empty;
        Response.Cookies["AuthToken"].Expires = DateTime.Now.AddMonths(-20);
        Response.Cookies.Add(new HttpCookie("AuthToken", ""));
    }
    Response.Redirect(Request.Url.AbsoluteUri);
}

Global.asax

<%@ Application Language="C#" %>

<script runat="server">

    void Application_Start(object sender, EventArgs e) 
    {
        // Code that runs on application startup

    }
    
    void Application_End(object sender, EventArgs e) 
    {
        //  Code that runs on application shutdown

    }
        
    void Application_Error(object sender, EventArgs e) 
    { 
        // Code that runs when an unhandled error occurs

    }

    void Session_Start(object sender, EventArgs e) 
    {
        // Code that runs when a new session is started

    }

    void Session_End(object sender, EventArgs e) 
    {
        // Code that runs when a session ends. 
        // Note: The Session_End event is raised only when the sessionstate mode
        // is set to InProc in the Web.config file. If session mode is set to StateServer 
        // or SQLServer, the event is not raised.        
    }       
</script>

Request Header on Login

1. Accept:
   text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
2. Accept-Encoding:
   gzip, deflate, br
3. Accept-Language:
   en-US,en;q=0.9
4. Cache-Control:
   max-age=0
5. Connection:
   keep-alive
6. Cookie:
   ASP.NET_SessionId=bg1znhl115xumzgqjtanar2c; AuthToken=029722f9-577c-46a7-b69b-a9fa5e339b39
7. Host:
   localhost:3850
8. Referer:
   http://localhost:3850/Remove_ASP.NET_SessionId/Login.aspx
9. Sec-Fetch-Mode:
   navigate
10. Sec-Fetch-Site:
    same-origin
11. Sec-Fetch-User:
    ?1
12. Upgrade-Insecure-Requests:
    1
13. User-Agent:
    Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Request Header on Logout

1. Accept:
   text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
2. Accept-Encoding:
   gzip, deflate, br
3. Accept-Language:
   en-US,en;q=0.9
4. Cache-Control:
   max-age=0
5. Connection:
   keep-alive
6. Cookie:
   ASP.NET_SessionId=; AuthToken=
7. Host:
   localhost:3850
8. Referer:
   http://localhost:3850/Remove_ASP.NET_SessionId/Login.aspx
9. Sec-Fetch-Mode:
   navigate
10. Sec-Fetch-Site:
    same-origin
11. Sec-Fetch-User:
    ?1
12. Upgrade-Insecure-Requests:
    1
13. User-Agent:
    Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

For more details on ASP.Net Session refer below links.

ASP.Net Session