Logging users in/out with Session object

[Christopher M.]

I'm using the Session object to manage things like usernames and passwords. (I'm not concerned about security.)

I'm having trouble overwriting session variables when a user tries to log in with a different username and password.

Exiting the browser seems to end the session. I've tried abandoning the session and removing the contents of the session variables but it doesn't seem to work.

The site is hosted on Godaddy.

Any ideas?

Thanks.

W. Pooh (AKA Winnie P.)

 

[Bob Barrows]

I'm using the Session object to manage things like usernames and passwords. (I'm not concerned about security.)

:shock: That is the most foolhardy statement I have heard in a long time.

I'm having trouble overwriting session variables when a user tries to log in with a different username and password.

What kind of trouble? Please try to describe your symptoms without using unhelpful generic terms like "not working", "having trouble", etc. We're not looking over your shoulder at your computer screen

Exiting the browser seems to end the session.

Well, duh! That is the definition of a session.
Actually, a session is not cleared immediately when the browser is closed. Lack of activity causes it to expire which is a good thing because sessions consume system resources. Opening the browser again forces a new session to start.

I've tried abandoning
the session and removing the contents of the session variables but it doesn't seem to work.

How do you know?

 

[Evertjan.]

Bob Barrows wrote on 03 dec 2010 in
microsoft.public.inetserver.asp.general:

[...]

Well, duh! That is the definition of a session.
Actually, a session is not cleared immediately when the browser is closed. Lack of activity causes it to expire which is a good thing because sessions consume system resources. Opening the browser again forces a new session to start.

There are two reasons why a session is no-longer available.

1 the clientside session-id cookie has expired,
because the browser is closed.

2 the session is closed by serverside time-out.

3 the session is closed by a serverside session.abandon command

4 the serverside application has/is restarted.

Hey, I count four already.
Bob, are there more?

You cannot remove session-variable content of a session.abandon-ned session, methinks.

How do you know?

Indeed.

"Doesn't work" is unacceptable newspeak
without showing testing ways and results.

Show us an example script, OP.

 

[Christopher M.]

"Bob Barrows" wrote:

Christopher M. wrote:
> I'm using the Session object to manage things like usernames and
> passwords. (I'm not concerned about security.)

:shock: That is the most foolhardy statement I have heard in a long time.

The application is just a simple form mailer.

> I'm having trouble overwriting session variables when a user tries to
> log in with a different username and password.

What kind of trouble? Please try to describe your symptoms without using unhelpful generic terms like "not working", "having trouble", etc. We're not looking over your shoulder at your computer screen

I'm not able to overwrite session variables. There's a field that stores the company id of a user. I'm not able to update the company id after a new user logs in with the same browser. The user has to close the browser before they can log in as a different user/company.

W. Pooh (Winnie P.)

 

[Adrienne Boswell]

Gazing into my crystal ball I observed "Christopher M." writing in

"Bob Barrows" wrote:

> Christopher M. wrote:
>> I'm using the Session object to manage things like usernames and
>> passwords. (I'm not concerned about security.)
>
> :shock: That is the most foolhardy statement I have heard in a long
> :time.

The application is just a simple form mailer.

And is there a database involved somewhere? Have you ever heard about SQL injection? If not, read up on it now.

>> I'm having trouble overwriting session variables when a user tries
>> to log in with a different username and password.
>
> What kind of trouble? Please try to describe your symptoms without
> using unhelpful generic terms like "not working", "having trouble",
> etc. We're not looking over your shoulder at your computer screen

I'm not able to overwrite session variables.

How are you doing this? Code sample, please - not too much, just the relavent asp.

There's a field that
stores the company id of a user.

What kind of field? A hidden form field, a session variable, a cookie?

I'm not able to update the company id
after a new user logs in with the same browser.

Why is a new user logging in with the same browser? Did the other user go away without logging out first?

The user has to close
the browser before they can log in as a different user/company.

How are you logging the user out? Are you clearing any client side cookies as well?

 

[Evertjan.]

Adrienne Boswell wrote on 04 dec 2010 in
microsoft.public.inetserver.asp.general:

> I'm not able to update the company id
> after a new user logs in with the same browser.

Why is a new user logging in with the same browser? Did the other user go away without logging out first?

Never trust logouts to be done.

> The user has to close
> the browser before they can log in as a different user/company.

How are you logging the user out? Are you clearing any client side cookies as well?

There is no need for deleting clientside cookies,
as long as the new login first does a session.abandon.

sql = "SELECT id FROM NamePwTbl
WHERE [loginname] = '"&CleanedName&"'' AND [passwrd] = '"&CleanedPw&"'"

If NOT mD.EOF Then
newIdFromSqlLoginApproval = mD("id")
session.abandon
session("userId") = newIdFromSqlLoginApproval
Else
.....

In a session environment there is no need for other non-persistent cookies but the session-id cookie and I would strongly disaprove of using such.

Old session-id cookies themselves do not do harm.