https://blog.securityps.com/2013/06/session-fixation-forms-authentication.html

Session Fixation & Forms Authentication Token Termination in ASP.NET: AccountController.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Transactions;
using System.Web;
using System.Web.Mvc;
using System.Web.Security;
using DotNetOpenAuth.AspNet;
using Microsoft.Web.WebPages.OAuth;
using WebMatrix.WebData;
using Mvc4WithAuthentication.Filters;
using Mvc4WithAuthentication.Models;

namespace Mvc4WithAuthentication.Controllers
{  
    [Authorize]
    [InitializeSimpleMembership]
    public class AccountController : Controller
    {
      
      /* skipped quite a few actions here */
      
      [HttpPost]
      [AllowAnonymous]
      [ValidateAntiForgeryToken]
      public ActionResult Login(LoginModel model, string returnUrl)
      {
          if (ModelState.IsValid && WebSecurity.Login(model.UserName, model.Password, persistCookie: model.RememberMe))
          {
              //store the user's identity in the session
              Session["UserName"] = model.UserName;                
              return RedirectToLocal(returnUrl);
          }

          ModelState.AddModelError("", "The user name or password provided is incorrect.");
          return View(model);
      }
      
      /* skipped quite a few actions here */
        
    }
}