Q:

Session Fixation in ASP.Net MVC

Is it possible to block an action to be executed directly from the browser, but still be able to redirect to it from inside the site? I know it sounds stupid but this is what I want:
Let's say there are two routes, Index and Index2 of HomeController.
www.website.com/home will cause Index to be executed, I then want to execute some code and then redirect (or server transfer) to www.website.com/home/index2.
I don't want the URL www.website.com/home/index2 to be accessed directly by the user, without going to home/index first.
Is there something I can do to deactivate/activate the route at runtime?
EDIT: Sorry, this question is titled "Session Fixation" because I need Index to run prior to Index2 to ensure we are killing all Sessions in Index and renewing them before Index2 executes.
I cannot kill the session and execute the code in Index2 in the same request since Index2 needs session to do its job.

A:

Not if you do a redirect.  If you do a redirect it will appear to the controller the same way as if the request simply originated at the browser (which it does).  You could gin something up with TempData -- i.e. set a flag there and only execute the action if the flag is in TempData -- but if it isn't the next request from the browser it will fail.  That is, you may get another request, say via AJAX, that comes between the original and the redirect.  The TempData would be wiped out by that request.
If, on the other hand, you simply want to execute the code, then don't expose Index2 as a public method and call it directly.  If it's in the same controller, this should just work.  You'll end up with the same URL, but if it's just getting the correct view that you want this should be ok.

A:

OK, this is what we ended up doing. Anyone see any caveats with this approach?
Index()
{
    expire all session and forms-Authententication cookies
}

Index2()
{
   if(Session.IsNewSession)
   {
      redirect to Index action
   } 
   else
   {
     Show view
   }
}

