Can I abandon an InProc ASP.NET session from a session different than one making the request? -

we have application single sign-on using centralized authentication server (cas). we'd single sign-out, such if user logs out of 1 application (say front-end portal), user automatically signed out of applications using same single sign-on ticket.

the expectation each application register sign-out hook (url) cas @ time of logon application. when cas receives sign out request 1 of applications, invokes sign-out hook application sharing sso ticket.

my question this: there way abandon inproc session different session? presume, since http request coming cas server, own session, session of user want terminate. have pretty idea of how using separate session state server, i'd know if possible using inproc session state.

haha, well... looks can. wondering myself if there way this, turns out, there is.

when use inproc, inprocsessionstatestore (internal class) persist session state in internal (non public) cache. can access cache through reflection , remove session state manually.

using system; using system.reflection; using system.web;  object obj = typeof(httpruntime).getproperty("cacheinternal",      bindingflags.nonpublic | bindingflags.static)         .getvalue(null, null);  if (obj != null) {     methodinfo remove = obj.gettype()         .getmethod("remove", bindingflags.nonpublic | bindingflags.instance,              type.defaultbinder, new type[] { typeof(string) }, null);      object proc = remove.invoke(obj, new object[] { "j" + state.sessionid }); } 

the end result is, next request take on same sessionid, httpsessionstate empty. you'll still session_start , session_end events.