Log Off Procedure 1

[seaport]

I used "session.abandon" code to let user log off an ASP application, and I found something interesting.

When I logged on the application as two users (with different user names) from the same computer, one user logging off also makes another user logged off.

When I logged on the application from two different computers with two different user names, this never happens.

Could anyone explain to me why?

Thanks in advance.

Seaport

 

[GIGN]

Server uses cookies to track sessions, so it knows if you are logging in from the same terminal. Both of the users have the same session.
[bb]

 

[Ovatvvon]

activeX is 99% right...just to clear it up a bit though, the session state uses "per-session" cookies. As he said, it's based on the computer to the server, not the login name to the server. Therefore, when you abandon the session state between the client and the server at any point, it is for the entire computer, not for the user.

Now, you could probably get by this little fact if you used one user on one browser (Internet Explorer) and the other user on another browser (like Netscape). They should be seperate then and if you logoff with one user, the other user should still be logged in.

Hope this clears it up a little more.
-Ovatvvon :-Q

 

[seaport]

Thanks you all.

I would like to talk about this issue a little bit further. I tried logging on to the application as two different users on the same browser. Obviously, there is only one session variable - session("UserID&quot. So these two users interfered with each other. Is there any way to resolve this (within ASP)?

Seaport

 

[Ovatvvon]

Unfortuanately, I don't believe there is a way around it; Since the session ID set in the per-session cookie is controlled by IIS, as is all the interaction between the client and the server on the session level.

But, I can't think off the top of my head when you'd have two or more people logged in to the same web site on the same computer at the same time. Is your site of such a nature that it would have this happen on a regular basis?

Not too many people count on the fact of signin into a site with multiple id's at the same time from the same machine. Take for instance yahoo.com. Not exactly the best analogy because they use Unix instead of win2k, however the theory works the same. If you log into one yahoo mail account, and without logging out try to log into it again with a different account it won't let you...as soon as you go to the mail.yahoo.com page, it forwards you to the logged in users mailbox. It didn't use to do that, instead it would just abandon the session with the old user and start the new account which is what will happen for you (or should anyway).

You could design your site to do the same as yahoo has and to log into that current users site until the session times out or the session state was abandoned (like 'logout').

Is it a necessesity for you to have multiple log-in's from the same machine at the same time? If so, I'm not sure how to help you out on that other than tell the users to use different browsers.

Sorry :-(
-Ovatvvon :-Q

 

[seaport]

Ovatvvon,

You are right. It is no necessary to have multiple log-ins.

thanks for your input.

Seaport