Detecting Session Timeout in ASP.NET 2.0 Web Application

Problem: An ASP.NET 2.0 web application needs to detect a session timeout condition so that the user can be redirected to a different page and / or an error message is displayed.
Solution: There are three ways of approaching this problem, starting off with the simplest one to the most complicated one. So, here it goes:
  1. Using Session["xxx"] value to determine the session timeout: This is a "quick and dirty" hack that can be introduced into an application to figure out whether a timeout has occured. We need to do two things here.
    First, in Global.asax, create your own GUID and put it in the session object,
        void Session_Start(object sender, EventArgs e)
           // Code that runs when a new session is started
           Session["CustomSessionId"] = Guid.NewGuid();

    , BasePage.cs which would have inherited Page, in PageLoad() event, check whether the Session["CustomSessionId"] == null, if it IS null, it means that the session was timed-out and AspNet runtime cleared it out.
        if( Session["CustomSessionId"] == null)
  2. Using a combination of Session.IsNewSession and Request.Cookies collection: Leveraging the behavior of ASP.NET runtime, we can check whether the Session.IsNewSession flag is true, if its true and we find that Request.Cookies["ASP.NET_SessionId"] has a valid value, it means that a timeout occured and a new request was generated by the runtime. This code fragment can be inserted into the OnInit(...) method in the BasePage class so that it applies across the application.
    protected override void OnInit(EventArgs e)
    if (Context.Session != null)
    //check whether a new session was generated
            if (Session.IsNewSession)
    //check whether a cookies had already been associated with this request
    HttpCookie sessionCookie = Request.Cookies["ASP.NET_SessionId"];
    if (sessionCookie != null)
    string sessionValue = sessionCookie.Value;
    if (!string.IsNullOrEmpty(sessionValue))
    // we have session timeout condition!
                                         // Response.Redirect("SessionTimeout.htm");
    Session["IsSessionTimeOut"] = true;

    WARNING:- We will have to wireup the "void Session_Start(object sender, EventArgs e)" method in the Global.asax to use the Session.IsNewSession meaningfully. ASP.NET 2.0 runtime is a bit weird in the sense that it will always return the value of Session.IsNewSession as true in case the Event is not wireup!
  3. Using HTTP Module: Arguably the most complex but robust way to tackle this situation. I would rather not go into this as this carries the risk of opening security holes in the HTTP stream

    from Nikhil's Blog 

2 nhận xét:

indiroma on May 25, 2009 at 5:30 AM said...

ITSolusenz departments manage all components web application, software development including, Application Development Company, software development company india, Software Development Services.

Jagna Co Kalani on December 12, 2017 at 12:56 AM said...

Hi, Great.. Tutorial is just awesome..It is really helpful for a newbie like me.. I am a regular follower of your blog. Really very informative post you shared here. Kindly keep blogging. If anyone wants to become a .Net developer learn from Dot Net Training in Chennai. or learn thru ASP.NET Essential Training Online . Nowadays Dot Net has tons of job opportunities on various vertical industry.
or Javascript Training in Chennai. Nowadays JavaScript has tons of job opportunities on various vertical industry.


Coding experience share Copyright © 2010 | Designed by Ipietoon for Free Blogger Template