Last updated: August 26, 2026.
The ASP Session object stores per-visitor values across requests using a session identifier cookie.
Set, read, and clear session values
<%
Session.Timeout = 20
Session("UserId") = 42
If IsEmpty(Session("UserId")) Then
Response.Redirect "/login.asp"
End If
Response.Write "User ID: " & CLng(Session("UserId"))
' At sign-out:
' Session.Abandon
%>Store only small identifiers and short-lived state. Rotate the session identifier after authentication where the surrounding platform permits, use HTTPS, and do not treat client-controlled cookies as proof of identity. In a server farm, configure a shared session strategy or avoid in-process state.
