Classic ASP: Multiple ASPSESSIONID in cookies

I was able to remove those cookies with Javascript.

Just add next script to the end of login page. This will remove all "ASPSESSIONIDXXXXXXX" cookies before user will login to website:

<script type="text/javascript">
    //Clear any session cookies
    (function(){
        var cookiesArr = document.cookie.split("; ");
        for (var i = 0; i < cookiesArr.length; i++) {
            var cItem = cookiesArr[i].split("=");
            if (cItem.length > 0 && cItem[0].indexOf("ASPSESSIONID") == 0) {
                deleteCookie(cItem[0]);
            }
        }

        function deleteCookie(name) {
            var expDate = new Date();
            expDate.setTime(expDate.getTime() - 86400000); //-1 day
            var value = "; expires=" + expDate.toGMTString() + ";path=/";
            document.cookie = name + "=" + value;
        }
    })();
</script>

You can use the URL Rewrite mod to rename the session cookie when it is set and use an inbound rewrite rule to revert it back again. Multiple session cookies occur when the session name ID changes, but by giving the session cookie a set name and including the ID within the cookie itself there will only ever be one session cookie at a time.

Use these rewrite rules in web.config to change

ASPSESSIONIDXXXXXXXX=YYYYYYYYYYYYYYYYYYYYYYYY

into

session=XXXXXXXX/YYYYYYYYYYYYYYYYYYYYYYYY

then revert it back again on an inbound request (so it can still be read by IIS):

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <rewrite>
        <rules>
            <clear />
            <!-- "HTTP_COOKIE" must be added to the "allowed server variables" in IIS under URLRewrite -->
            <rule name="session cookie revert">
                <match url="(.*)" />
                <conditions>
                    <add input="{HTTP_COOKIE}" pattern="(.*)session=([0-9a-zA-Z]+)\/([0-9a-zA-Z]+)(.*)" />
                </conditions>
                <serverVariables>
                    <set name="HTTP_COOKIE" value="{C:1}ASPSESSIONID{C:2}={C:3}{C:4}" />
                </serverVariables>
                <action type="None" />
            </rule>
        </rules>
        <outboundRules>
            <rule name="session cookie rewrite">
                <match serverVariable="RESPONSE_Set_Cookie" pattern="ASPSESSIONID([0-9a-zA-Z]+)=([0-9a-zA-Z]+)(.*)" negate="false" />
                <!-- Set the session cookie as HttpOnly during the rewrite. Classic ASP doesn't 
                do this by default, but it's important for preventing XSS cookie stealing. 
                You could also add "; Secure" if you only want the session cookie to be passed 
                over an SSL connection, although this also means the cookie can only be set over 
                an SSL connection too, which could be a problem when testing on localhost. -->
                <action type="Rewrite" value="session={R:1}/{R:2}{R:3}; HttpOnly" />
            </rule>     
        </outboundRules>
    </rewrite>
  </system.webServer>
</configuration>

This issue also troubled me for a long time. And I cannot solve it.

It's none of browsers business. My Chrome, Firefox, IE all have this issue.

Sometimes I can see 20+ ASPSESSIONIDXXXX cookies in one page.

Finally I must use javascript to clear the old ASPSESSIONID*** and keep the latest one.

function clearASPSESSIONID(){
    var cks = document.cookie.match(/\b(ASPSESSIONID[A-Z]+)(?==)/g),
        lskey = 'oldASPSESSIONID-'+location.protocol+'//'+location.host,
        old = window.localStorage ? localStorage.getItem(lskey) : '',
        keep, i;
    for(i=0;i<cks.length;i++){
        if((old && old.indexOf(cks[i])<0) || i==cks.length-1){
            keep = cks[i];
        }
    }
    for(i=0;i<cks.length;i++){
        if(keep != cks[i]){
            document.cookie = cks[i] + '=; expires=Thu, 01 Jan 1970 00:00:01 GMT;';
        }
    }
    if(window.localStorage){
        localStorage.setItem(lskey, keep ? keep : '');
    }
}
clearASPSESSIONID();

Go to Application pool 'advanced setting" and set "Maximum Worker Processes" to 1.