Forms auth and session question...

[Jon]

If a session times out, but the forms auth is still logged in it's possible
for users to go to pages on the site that need those session variables. I
was under the impression that using forms auth would make it so I would not
need to check if session vars were still around.

I'm confused! Perhaps someone can clear this up for me?

 

[Darrin J. Olson]

Even more than that, should users who's sessions have timed out be able to
even get to the pages? When the session times out and the user makes a page
request, does it take them to the specified "login page"? After that, can
they go to pages that should be restricted? If so, it may have to do with
how you are restricting access to those pages.

Do you use the location tags in the web.config file to restrict directories
or pages?

I beleive the session vars should be gone when a session times out. You
could possible put code in the Session_End event of the Global.asax to be
sure they are cleared, but I wouldn't think this should be necessary,
either.

-Darrin

 

[John Saunders]

If a session times out, but the forms auth is still logged in it's
possible for users to go to pages on the site that need those session
variables. I was under the impression that using forms auth would make it
so I would not need to check if session vars were still around.

I'm confused! Perhaps someone can clear this up for me?

Forms Authentication is independant of Session. They have nothing to do with
each other.

Consider placing access to Session "variables" into properties which can
handle the case of Session variables disappearing:

Private _table As DataTable

Protected Property Table() As DataTable
Get
If Session("table") Is Nothing Then
' Do whatever you have to in order to get the data
' back into Session state
_table = New DataTable("table")
_table.Columns.Add("column1", GetType(String))
_table.Columns.Add("column2", GetType(String))
Session("table") = _table
Else
_table = DirectCast(Session("table"), DataTable)
End If
End Get
Set(ByVal Value As DataTable)
_table = Value
Session("table") = _table
End Set
End Property

Your code then refers to Table, for instance:

Dim dr As DataRow = Table.NewRow()
dr("column1") = TextBox1.Text.Trim()
dr("column2") = TextBox2.Text.Trim()
Table.Rows.Add(dr)

BTW, Session state can disappear for more than one reason. For instance, if
the application is reset due to changes to web.config or to assemblies in
the bin directory.

Also, as an aside, code like the above also works for data stored in Cache.

John Saunders

 

[Jon]

So, if the session can be gone but the user can still have access to a
page...is there a simple way to check on every page for the presence of a
session var without adding code like the following:

if session("var") is nothing then...?

I had created a new base class that inherits web.ui.page and checks for
session...but, then that breaks the designer mode of vs.net. I'm going in
circles here trying to determine the best way to check on every page whether
a session var is set or not. Is it simply to put that code (if
session("var") is nothing...) on every single page?

Thanks for helping me clear this up!

Even more than that, should users who's sessions have timed out be able to
even get to the pages? When the session times out and the user makes a
page request, does it take them to the specified "login page"? After that,
can they go to pages that should be restricted? If so, it may have to do
with how you are restricting access to those pages.

Do you use the location tags in the web.config file to restrict
directories or pages?

I beleive the session vars should be gone when a session times out. You
could possible put code in the Session_End event of the Global.asax to be
sure they are cleared, but I wouldn't think this should be necessary,
either.

-Darrin

 

[John Saunders]

So, if the session can be gone but the user can still have access to a
page...is there a simple way to check on every page for the presence of a
session var without adding code like the following:

if session("var") is nothing then...?

I had created a new base class that inherits web.ui.page and checks for
session...but, then that breaks the designer mode of vs.net. I'm going in
circles here trying to determine the best way to check on every page
whether a session var is set or not. Is it simply to put that code (if
session("var") is nothing...) on every single page?

The base page idea works if you don't put any controls in the base page.
However, you can put a property in the base page. Such a property can
contain the code to check for Nothing, so that it doesn't have to be
repeated on each page.

John Saunders

 

[Jon]

The base page idea works if you don't put any controls in the base page.
However, you can put a property in the base page. Such a property can
contain the code to check for Nothing, so that it doesn't have to be
repeated on each page.

John Saunders

I made the following base class and inherit from it and get the deisnger
error. It contains nothing except code to check the session. It's simply a
class file.

*****************
Public Class PageAuth
Inherits System.Web.UI.Page

Public Sub New()
AddHandler MyBase.Load, AddressOf Me.PageAuth_Load
End Sub

Private Sub PageAuth_Load(ByVal sender As System.Object, ByVal e As
System.EventArgs)
AccessCheck()
End Sub

Private Sub AccessCheck()
Dim oTemp As Object

oTemp = Session("UserEmpNo")

If oTemp Is Nothing Then
Response.Redirect("login.aspx?s=NoSession", True)
End If

If CType(oTemp, String) = "" Then
Response.Redirect("login.aspx?s=NoSession", True)
End If
End Sub
End Class
********************************

I also attempted this by making a new aspx page and put nothing on it except
the following code in the load event, and then inherited from it. Same
error.

******************
Dim oTemp As Object

oTemp = Session("UserEmpNo")

If oTemp Is Nothing Then
Response.Redirect("login.aspx?s=NoSession", True)
End If

If CType(oTemp, String) = "" Then
Response.Redirect("login.aspx?s=NoSession", True)
End If
*******************
Could you possibly show me an actual example of page inheritance working
with the designer. Sample code would be really wonderful at this point. I
appreciate your time!

 

[John Saunders]

I made the following base class and inherit from it and get the deisnger
error. It contains nothing except code to check the session. It's simply
a class file.

....

Sorry, I just tested with VS2002 and I see that you're right. My experience
was with a base class for UserControls, which works.

The test I did was to create an entirely empty base class (not even a
constructor) which inherits Page. My derived page inherited my base page.
This caused no error from the designer, but the all of the items on the
toolbox "Web Forms" tab were disabled. Strangely, the items on the "HTML"
tab were all enabled and I was able to drag them to the page. Even stranger,
I was able to enter <asp:Label> in the HTML, and see it rendered in the
designer (though I couldn't select it). It works just fine for user
controls, and works for pages in VS2005 Beta 1 (add Inherits="BasePage" to
the <%@ Page %> directive).

Since inheritance doesn't work, a thought is to not inherit from the "base
class", but to have each page contain an instance of it. For instance,
instead of

Public Class WebForm2
Inherits BasePage

Private Sub Page_Load(ByVal sender As System.Object, ByVal e As
System.EventArgs) Handles MyBase.Load
AccessCheck() ' MyBase.AccessCheck()
End Sub
End Class

use

Public Class WebForm2
Inherits System.Web.UI.Page

Private _base As New BasePage()

Private Sub Page_Load(ByVal sender As System.Object, ByVal e As
System.EventArgs) Handles MyBase.Load
_base.AccessCheck()
End Sub
End Class

John Saunders