Session-State In-Process (InProc) mode: When is it forgotten?

Question

I'm using the InProc session-state mode in my web application.

In order to test the client's behavior on a session loss I restarted the web server, first just iis, then the entire machine. Both actions did not lead to a session loss.

This puzzles me: The session is stored on memory, right? How can the session be retained after the machine restarted? Does IIS dump the sessions on disk on a restart? If so, where is this documented and how do I flush the sessions for testing purposes?

I'm using IIS 8 on Windows Server 2012.

EDIT: I don't know whether I actually lose the session - what I know is that my cookie is still accepted. (I don't actually use any "session", I just need to authenticate the user.) It could be that the authentication ticket is usable even after the actual session is lost, as is suggested here.

EDIT: Also look here for more information about the forms authentication cookie and what's in it.

Answer 1

Contrary to what I assumed, the authentication entry in the cookie isn't merely an opaque identifier of a session, but actually a encrypted username with an expiry time. It is not directly related to a session at all, and its validity is independent of the validity of any sessions.

That means that the expiry of authentication and the loss of the session are two distinct events that usually occur at different times.

Look at this and this link for more information.