Hi,
Thanks for your inputs.
Bruce, as u suggested there could be problem because of static
variables(session).
I'm using Login.fnVerify_Login which is a shared function. Is this the
problem??
Kindly advice
Ok let me explain my coding implementation part.
Since I have selected InProc mode for Session State, I’m using global.aspx
for session handling.
‘************* Global.asax file **********
Sub Session_Start(ByVal sender As Object, ByVal e As EventArgs)
' Code that runs when a new session is started
‘Totally I have some 5-6 session variables added here.
‘Only session variables are added here when a new session is intialized.
Session.Add("UserID", "")
Session.Add(“CompNameâ€,â€â€)
End Sub
Sub Session_End(ByVal sender As Object, ByVal e As EventArgs)
' Code that runs when a session ends.
' Note: The Session_End event is raised only when the sessionstate
mode
' is set to InProc in the Web.config file. If session mode is set to
StateServer
' or SQLServer, the event is not raised.
Session("UserID") = Nothing
Session(“CompNameâ€)=Nothing
End sub
'******* Web.config file *********
<?xml version="1.0"?>
<!--
Note: As an alternative to hand editing this file you can use the
web admin tool to configure settings for your application. Use
the Website->Asp.Net Configuration option in Visual Studio.
A full list of settings and comments can be found in
machine.config.comments usually located in
\Windows\Microsoft.Net\Framework\v2.x\Config
<configuration xmlns="
http://schemas.microsoft.com/.NetConfiguration/v2.0">
-->
<configuration xmlns="
http://schemas.microsoft.com/.NetConfiguration/v2.0">
<appSettings>
<add key="testCon" value="Initial Catalog=testwebdb;Data Source=test;User
Id=testdbdb; pwd=test;" />
<add key="PageRecordSize" value="3" />
</appSettings>
<system.web>
<!-- Refer the URL
http://support.microsoft.com/kb/317604/ for the below
sessionState
Set compilation debug="true" to insert debugging
symbols into the compiled page. Because this
affects performance, set this value to true only
during development.
Visual Basic options:
Set strict="true" to disallow all data type conversions
where data loss can occzur.
Set explicit="true" to force declaration of all variables.
-->
<globalization enableClientBasedCulture="true" />
<trace enabled="false" pageOutput="false"/>
<compilation debug="false" strict="false" explicit="true"
defaultLanguage="vb"/>
<pages enableViewState="false" validateRequest="false">
<namespaces>
<clear/>
<add namespace="System"/>
<add namespace="System.Collections"/>
<add namespace="System.Collections.Specialized"/>
<add namespace="System.Configuration"/>
<add namespace="System.Text"/>
<add namespace="System.Text.RegularExpressions"/>
<add namespace="System.Web"/>
<add namespace="System.Web.Caching"/>
<add namespace="System.Web.SessionState"/>
<add namespace="System.Web.Security"/>
<add namespace="System.Web.Profile"/>
<add namespace="System.Web.UI"/>
<add namespace="System.Web.UI.WebControls"/>
<add namespace="System.Web.UI.WebControls.WebParts"/>
<add namespace="System.Web.UI.HtmlControls"/>
<add namespace="System.Data"/>
<add namespace="System.Data.OleDb"/>
<add namespace="System.Drawing"/>
<add namespace="System.Net"/>
<add namespace="System.Net.Mail"/>
</namespaces>
</pages>
<!--
The <authentication> section enables configuration
of the security authentication mode used by
ASP.NET to identify an incoming user.
-->
<authentication mode="Forms">
<forms loginUrl="login.aspx" timeout="25" name="sqlAuthCookie" />
</authentication>
<authorization>
<!--<deny users="?" />-->
<allow users="*" />
</authorization>
<!--
The <customErrors> section enables configuration
of what to do if/when an unhandled error occurs
during the execution of a request. Specifically,
it enables developers to configure html error pages
to be displayed in place of a error stack trace.
-->
Custom errors handled in global.asax file
<customErrors mode ="On" defaultRedirect ="\Errpage.aspx"/>
<sessionState
mode="InProc"
cookieless="false"
stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;user id=;password="
timeout="20"/>
</system.web>
</configuration>
'******* end of web.config file.*****
I have a login page where user inputs UserID & Password, when the page is
submitted a submit event handler is called like given below.
Private Sub btnSubmit_Click(ByVal sender As Object, ByVal e As
System.EventArgs) Handles btnSubmit.Click
Page.Validate()
If Login.fnVerify_Login(Server.HtmlEncode(txtUserName.Text),
Server.HtmlEncode(txtPassword.Text), chkID.Checked.ToString) Then
HttpContext.Current.Session.Item("UserID") =
txtUserName.Text.ToString
‘ other code follows here
End if
End sub
‘ Session variable added in Session_Start is assigned a value in the above
event.
‘the above event also calls Login.fnVerify_Login function. The following is
the definition of that function.
‘calls clsLogin.fnVerify_Login is a shared function. Is this the problem??
Public Shared Function fnVerify_Login(ByVal UserID As String, ByVal UserPwd
As String, ByVal SaveMe As String) As Boolean
Dim oCmd As New SqlCommand
Dim SqlParamID As New SqlParameter
Dim SqlParamPWD As New SqlParameter
Dim SqlConn As SqlConnection
Dim SqlDataReader As SqlDataReader
SqlConn = cCls.DBConnect()
oCmd.CommandText = "dbo.WS_Select_LoginDetails"
oCmd.Connection = SqlConn
oCmd.CommandType = CommandType.StoredProcedure
SqlParamID = oCmd.Parameters.Add("@i_UserID", SqlDbType.Char)
SqlParamID.Value = UserID
SqlDataReader = oCmd.ExecuteReader
If (SqlDataReader.Read) Then
Dim dbPasswordHash As String = SqlDataReader.GetString(3)
Dim salt As String = SqlDataReader.GetString(4)
Dim passwordAndSalt As String = String.Concat(UserPwd, salt)
Dim hashedPasswordAndSalt As String
hashedPasswordAndSalt =
FormsAuthentication.HashPasswordForStoringInConfigFile(passwordAndSalt,
"SHA1")
'--------- work normally, check done by formsauthentication
encryption.
If hashedPasswordAndSalt.Equals(dbPasswordHash) Then
HttpContext.Current.Session.Item("CompName") =
SqlDataReader.Item("CompName").ToString
fnVerify_Login = True
Else
fnVerify_Login = False
End If
End If
End If
If SqlConn.State = ConnectionState.Open Then
SqlConn.Close()
SqlConn.Dispose()
End If
End Function
