Hello,
I posted a simular question in the "IIS Security" group but it think it
is more usefull to post it here.
I want to do something very simpel. Make a part of my website available
only for users with a username and password. The site is mainly ASP
based. The webserver is an IIS6 and I do NOT have access to server
settings (session timeout, security,...).
I use sessions to set the validation for the users. Basically you are
redirected to a form where you can give a username and password, this is
validated with the values in a database. If the password and username
are ok a session value is set <%=Session("Val idated")=True%> *.
At the beginning of each secured page I start with:
<%If Session("Valida ted")=False Then Response.Redire ct("Login.asp" ) End
If%>
So if the session value "validated" is true you can see the secured
pages, else you are redirected to the logon page.
The default timeout value for session is 20 minutes. Because the session
should stay alive during the complete time of the visit I was thinking
of puting the session.timeout to 60 minutes. I set this at the beginning
of every secure page: <%Session.timeo ut=60%>
Now, Users keep on contacting me saying that they have to relogon quiet
often. This also seems to happen when a user is not on the website for
20 minutes already (session expired). I tested it myself and have the
feeling the I am indeed regularly redirected. Sometimes after 10
minutes, other times 30 minutes, ... There seems not to be any logic in
the time that users are redirected to the logon page.
Because the website is used to fill in a lot of long HTML forms, it is
very frustrating for the users when they are completing a form and then
pressing "Submit" being redirected to the logon page and lose all
entered data.
Is there somebody who can give me more info on the strange session
behavior? For me it is not normal that a session times out in that
unlogic way.
The only solution I can think of is passing the post information to the
logon page and then redirect after validation back to the transaction
page.
How can you reset the timeout counter on a session in ASP? What I was
thinking was that I am doing it maybe wrong?
Now the session variable that let a user have access to the site is set
once at logon time: (<%=Session("Va lidated")=True% *>*). Then it is
checked on every page that the user opens (<%If
Session("Valida ted")=False Then Response.Redire ct("Login.asp" ) End If%>)
Would it be a good idea to re-set the variable every time a user
accesses page? Like <%If Session("Valida ted")=False Then
Response.Redire ct("Login.asp" ) Else Session("Valida ted")=True End If%>
Would this reset the timer that times out the session? Or do I have to
add something like <%Session.Aband on%> before setting the variable
again?
What would this do on the server performance?
Is this a good way of working with sessions?
Swicth to cookies i.o. sessions?
I am open for all suggestions, please help! In the future there are also
money transactions going over this website, so it has to be a secure
method! I will use a seperate HTTPS host for this.
Thanks for you help!
*** Sent via Developersdex
http://www.developersdex.com ***
