Session_Start issue

[=?Utf-8?B?U00=?=]

Hi,

We had the following code in our global.asax.cs file when our code was in
..net 1.1
Please note that our production environment uses SSL ad windows
authentication based single sign on.

protected void Session_Start(Object sender, EventArgs e)
{
if (Request.IsSecureConnection == true)
Response.Cookies["ASP.NET_SessionID"].Secure = true;

}

When we upgraded our system to .net 2.0 , all users started getting session
loss in the first attempt to access the site.

Microsoft support engineer suggested to move the above code to application
end request event. Although this move resolved the above issue , he was not
able to provide a satisfactory explanation on why this code has to be moved
from session start event.

Microsoft suggested code move :
protected void Application_EndRequest(Object sender, EventArgs e)
{
//Code originally from Session_Start

if (Request.IsSecureConnection == true)
Response.Cookies["ASP.NET_SessionID"].Secure = true;
}

I would like to know if anyone could provide an explanation for this move
from their own experience or knowledge.