The answer was quite simple.
I tried to understand how works a mechanism for storing sessions in ASP.NET. In my case, the sessions stores in the SQL Server database
SessionStateService_bf7ce9929397425d9b58d03b91699180 (default provision). This database contains two tables
ASPStateTempSessions. If you look at this tables you can see the main idea why diffirent applications has diffirent sessions.
SessionId column consist of two parts:
HttpContext.Current.Session.SessionID) and second part is the app-hash. App hash is unique for each applications, actually it is hash-function of two variables: AppId and MachineName. AppId generated by
dbo.TempGetAppID stored procedure, MachineKey is property of each web.config (or machine-level machine.config).
So all you need to fix the stored procedure and web.config. I added to the
dbo.TempGetAppID procedure this line at start:
SET @appName = 'singlesession'
Then I provided same validation and decryption keys in the
<machineKey/> config section of web.config for both zones - "http" and "https".
So I got single HttpContext.Current.Session for each web-applications.