Session Timeouts and Variables

[dcusick]

Okay... I have a web app that requires a user to login. Part of the requirements is to not allow the user to login twice. So, I figured I could use an Application object in order to hold a list of users logged in. When they log in, I will check the list to make sure that they aren't already in there, and if not, add them. I add this into a Session Variable, for use throughout the app. When the user logs out, I have code to remove it from the Applicaion Object, in the Session_End event in my globals.asax.

My problem is this... If the user closes the browser without signing out, the entry doesn't get removed. Also, if the session times out, does Session_End get called? And if so, is the session object still available within this event? I need to grab the username from the Session in order to know who to remove from the Application.

Any ideas? Thanks in advance...

Doug

 

[vbkris]

this concept is one of the most head breaking concept.

actually speaking the Session_End event is fired only whne u Abandon the session (using code).

otherwise its a dud (comments invited)

i wouldnt suggest that it is impossible, i have seen it in the paypal website...

Known is handfull, Unknown is worldfull

 

[dcusick]

Okay, sounds about the same as everything I've read... I think I figured out a way around this...

I have my sign-out button, which when clicked, calls Session.Abandon(). When my app session times out, the Session_End event IS called, and the values of the Session variables are still populated within this function. Now I added a Page_Unload function to each of my pages, with the

this.Unload += new.System.EventHandler(Page_Unload)

code and within that Page_Unload method, I call Session.Abandon(). Seems to be working relatively well right now. Slightly annoying, but it works... Thanks for the input!

 

[vbkris]

but that will destroy the session once the page unloads, why use sessions in that case???

Known is handfull, Unknown is worldfull

 

[dcusick]

Heh... You know, I just realized that... Thought it was a working solution, but definitely not... I just need to know when a user logs off, or closes the browser. Back to the old drawing boards...

 

[jbenson001]

In IE you can use the onbeforeunload event. YOu have to code some javascript for it. There are many examples if you Google for it.

 

[vbkris]

tracking of wndow closing is impossible.

ok lets try an alternative, if u r using SQL server then u could try this:

1. create a time stamp for each login.
2. Run a job fo every 10 minutes (a "job" option does not come with shared servers)
3. If any timestamp is older than XXX minutes simply set its status to "N" or whatever...

Known is handfull, Unknown is worldfull

 

[dcusick]

Yeah, the problem is that we are using an AS/400 DB2 database, and company policy states we cannot use SQL Server... So I am using In Proc for my sessions...

A colleague brought up an idea... An admin feature that lists the users in the Application object, and a way to select one of them to remove. That way, Session_End will be called when the session times out, or if the user logs out. If the user closes the window by mistake, then they will need an admin to remove their login from the Application object. Probably not the MOST efficient code here, but don't think I have much else of a choice here.. Thanks vbKris and jbenson for your input.

 

[jbenson001]

Take a look at the onbefourunload event, I have used it and it works.

 

[vbkris]

jbenson, that would involve opening a popup right? in that case why not use onunload? its cross browser...

Known is handfull, Unknown is worldfull

 

[dcusick]

jbenson... I was looking to fire an event immediatly on close, I wasn't really looking to pop open a confirm box. But thank you for the suggestion!

vbkris, the onunload event will call no matter what happens, correct? Much like you pointed out to me above. If they navigate within the app, I don't really want this to fire... This seems to be getting confusing for even me!

 

[dcusick]

Well, found an interesting solution to this.... for anyone looking for a possible resolution...

On Body load, you need to set a variable to true... On every link on your page, you need to set this same variable to false in the onClick event... And then in the onUnload event, you check this variable... if true, then you would assume that the user clicked the "X" button from the control box, or typed in a URL in the address bar. If false, then you would make the assumption that the user clicked on one of your links, and is still within the application...

I'm sure this isn't a perfect solution, but it has the basic ability to capture specific events.