If a session variable is used on a page to stored data, then that session variable should be set to null when leaving that page. All session variable used in an ASP.NET application should be check for null during the Global.asax file session end event, and if it is not null, then it should be set to null at the end of a user session.
///--------------------------------------------------------------------------
/// <summary>
/// Method Name: Session_Start
/// Description: Triggers when the session begins to initialize variables
/// </summary>
///
/// <param name="sender">object</param>
/// <param name="e">event argument</param>
///----------------------------------------------------------------------
protected void Session_Start(object sender, EventArgs e)
{
Session["ID"] = 0;
Session["Header"] = string.Empty;
Session["BreadCrumb"] = string.Empty;
Session["UserID"] = string.Empty;
}
At the end of the session, the variables will be set to null:
///--------------------------------------------------------------------------
/// <summary>
/// Method Name: Session_End
/// Description: Triggers when the session ends to set variables to null
/// </summary>
///
/// <param name="sender">object</param>
/// <param name="e">event argument</param>
///--------------------------------------------------------------------------
protected void Session_End(object sender, EventArgs e)
{
Session["ID"] = null;
Session["Header"] = null;
Session["BreadCrumb"] = null;
Session["UserID"] = null;
}
For medium to large scale ASP.NET applications, session state could be persisted and managed in a SQL Server database per the instructions at:
http://support.microsoft.com/kb/311209