Why on earth would a .jpg need an asp.net session? Because any request to a given resource on a given domain -- images, scripts, stylesheets, everything -- includes all the cookies for that domain, ...