When the browser is closed (w/out clicking on log out) and user launches the site using a new session, it does not prompt user to login credential page, rather it takes the user back to the previous session.
It seemed to keep the session cookies from staying on the client after the browser was closed. Another strange this is that I can close the IE and open FireFox and the session is in there too. HOW IS THAT? I am thinking it is how my environment is setup. I have the sessions set for InProc and using cookies in IIS. What is different in IIS7?
Update: I am using integrated mode for my app pool. I looked at an older site I created using .net 3.5 and iis6 running on Sever2003. I can log into the site and it creates the session variable for me. I then go to FireFox and open the same site. It requires me to log in (my application will take you to your prfile if a session exists). If I then close IE and reopen IE, then go back to my site, it requires me to log in again. What is happening with iis7 and my current application, is quite odd. The only difference in how my session is pulled is that I am getting the variable while casting the current handler to the Page object: (Page)HttpContext.Current.Handler
Update: well, I think i found where the issues is and it has to do with casting the HttpContext.Current.Handler to the current page object. I have a configuration file where I wanted to put a property so all other classes could reference a central point to grab the User session object I created. The HttpContext.Current.session was always null and someone had suggested casting the HttpContext.Current.Handler. I created a simple page that checks to see if a session varaible has been created and if not it creates it. Then I print out the value. When I close the browser, the session is GONE. So, that is working. The code I had origianlly in this message was really for the back button, So I guess it is not clear why that session pulled from the Hnadler is always available until I speicifcally clear it.
i want your opinion about the Response.AddHeader("Refresh", Convert.ToString((Session.Timeout * 60) - 20))that i have seen in some sites that is used for refresh the page every time a little bit before the session expires
I am using a timer in the master page of my web site in order to keep a 'status bar' up to date with all sorts of information.The issue is that the whole point of session expiry goes to waste, because a postback is always being made (although asynchronic) to the server.
How can i still expire the session after a wanted period of time?
I cache information about the currently logged in user in the session. This info lazy loads whenever a CurrentUser property on my global application class is used. It does this by calling GetUser() on my custom implementation of MembershipProvider, which either loads the user up from the session, or loads the user from the DB and throws the user object in the session.
How should I handle this scenario?
User logs in. Administrator deletes user (or deactivates...the point is they can't log in any more). User's session expires. User navigates to a page or makes a request, or whatever.
Currently if this scenario occurs, NullReferenceExceptions are thrown all over the place, because the ASP .NET framework calls GetUser() which returns nothing because it can't find the user in the database (and there's nothing in the session because it expired).
I have a simple ASP.NET 4 site. I am using Forms Authentication. I have Session timeout set to 20 minutes. Also when the user authenticates I set the AuthenticationTicket to expire in 20 minutes. So normally everything works fine. If there is more than 20 minutes of inactivity and the user requests a page on the site they are redirected back to the Login page as I would expect.
However, let's say that the user is on a page that contains a form. Then they wait 25 minutes. Then they go to submit the form. Instead of being redirected back to the Login page, the site attempts the postback and I immediately get errors because there is code in the postback that attempts to get information out of Session.
It seems like ASP.NET does not redirect back to Login on postback if the AuthenticationTicket and Session has expired. How can I handle this? I hope I don't have to write special code on each page.
Page2 having Button 2 and an ascx control UC1. UC1 has a Button 3. Page2 is a modal dialog ( window.showModalDialog )
on Click of Button1 open Page2(modal dialog).
Page2 has UC1. UC1 has a button B3. On click of B3,instead of directly going to B3_click event, another post back happens. Thereafter opens login.aspx in another browser ( It is losing Session containing UserDetails as well as other session details).
now even If I continue entering Username and password, page2 reloads again in the new browser.
I am totally lost.
1) I do not know why UC1 button click makes another postback and thereafter opens up into another page losing all the sessions!!
I want to retain teh sessions till i go back to page1.
I am working on roles. Allocated some tasks to Annonumous User and LoggedIn User. What happen, once I login it shows me the correct task for LoggedIn user. But if I restart the application then by default it shows me LoggedIn users tasks. I am testing chrome and I.E.
I simply want to display a message on the login page when the user is automatically redirected there after requesting a page that they were logged in for but their session has now expired. So essentially if the user was working but stepped away for a lunch break without logging out I want the system to tell them why they were sent back to the login page.
Something like "You have been idle for too long so you must log back in".
This has to be easy I am just running into a wall here. I thought about getting the original ticket and reading the expiration date but I'm a little lost.
In my asp.net website I am creating a session upon user login and I would like to perform some operations in the database just before this session will expire.I am having problem in determining where should I write code and how will I know the session is going to expire.
I am not sure if 'session_end' event of 'Global.asax' suits my requirements as the session I want to check is created manually(not a browser instance).
On localhost works well. On the hosting server expires very quickly. Sometimes after a minute, and sometimes after a few minutes.
I tried mode="StateServer" and mode="SQLServer", but first works the same, other doesn't work. The next problem is that End_Session in global.asax doesn't executes if mode is not InProc. And I need this.
How could I achive that session expires only when browser is closed or other url is typed. Just setting timeout doesn't work.
my web app doesn't use authorization in web.config, but i want to detect when a session has expired and redirect to the home page.I have searched and found solutions that rely on the web app using authorization. Other solutions have implemented a user control to drop in every page.Obviosly i don't want to manually check for null on every session variable on every event of the web app, so i want the app to do it automatically.
I need to perform an operation such as extracting the data for past one year from DB and doing some manipulations and finally displaying the excel graphs for the extracted data. The extraction of data takes almost 6-7 hrs. What i require is that user enters the required data (date and some other details )through an asp.net page and submits it and then closes the browser. Now a process should get started which will extract all data and create the graphs and finally send an email to the particular user.