sessionid question

[Stephanie Stowe]

I have been out of this group for so long, then 2 questions in one day! Let
me give some background on what I am trying to do.....

I have an IIS server running ASP apps. I have a Websphere server being a
servlet container (and a couple of other things) running java servlets and
JSP. We are migrating our online services to JSP etc.. In the meantime, I am
trying to build an artifical session bridge. Imagine this...

A person logs into the Online Services (henceforth OS to reduce typing) in
ASP. For the time being, login will continue to reside within the ASP app
set. They request various services; go look at their loan info, go look at
their grant info, all within the ASP service set. Then they request a
service which is JSP (unbeknownst to them, of course). Off we send them to
JSP land on a different server. We send over a unique identifier of the
person. At the point when they request the JSP service, I will:

-store and pass a unique session identifier in some mechanism which is
available to both JSP and ASP (a domain specific cookie with no expiry, post
back and forth... something)
-store all session name value pairs to a database keyed on the
aforementioned unique session identifier
-pass a unique person identifier

So off they go to JSP, we can know who they are and pull there personal info
from the database in which it is stored. When they come back, I can rebuild
their state from the session name value pairs in the db even if the ASP
session has expired while they were gone.

So my question is, can I use the ASP SessionID for my unique session
identifier? I know that they are reused. But does anyone know how and when
they are reused? The session will be maintained within the database, and
will have a mechanism for cleaning up expired sessions. So I am not trying
to key a real persistant data system on it.

Thanks for the help!

S

[Mark Schupp]

IIRC the ASP session id "counter" resets when the ASP application re-starts
(change to global.asa, reboot, iisreset, etc). If your ASP application
always controls the session id, and it is not on a web-farm, and you clear
the session table in the database when the application restarts then you
should be ok. I would probably use an id guaranteed to be unique in the
database myself (autonumber column in Access, identity column in SQLServer)

--
Mark Schupp
Head of Development
Integrity eLearning
www.ielearning.com
"Stephanie Stowe" <st***@whackthisvsac.org> wrote in message
news:ej**************@TK2MSFTNGP10.phx.gbl...

I have been out of this group for so long, then 2 questions in one day! Let me give some background on what I am trying to do.....

I have an IIS server running ASP apps. I have a Websphere server being a
servlet container (and a couple of other things) running java servlets and
JSP. We are migrating our online services to JSP etc.. In the meantime, I am trying to build an artifical session bridge. Imagine this...

A person logs into the Online Services (henceforth OS to reduce typing) in
ASP. For the time being, login will continue to reside within the ASP app
set. They request various services; go look at their loan info, go look at
their grant info, all within the ASP service set. Then they request a
service which is JSP (unbeknownst to them, of course). Off we send them to
JSP land on a different server. We send over a unique identifier of the
person. At the point when they request the JSP service, I will:

-store and pass a unique session identifier in some mechanism which is
available to both JSP and ASP (a domain specific cookie with no expiry, post back and forth... something)
-store all session name value pairs to a database keyed on the
aforementioned unique session identifier
-pass a unique person identifier

So off they go to JSP, we can know who they are and pull there personal info from the database in which it is stored. When they come back, I can rebuild their state from the session name value pairs in the db even if the ASP
session has expired while they were gone.

So my question is, can I use the ASP SessionID for my unique session
identifier? I know that they are reused. But does anyone know how and when
they are reused? The session will be maintained within the database, and
will have a mechanism for cleaning up expired sessions. So I am not trying
to key a real persistant data system on it.

Thanks for the help!

S

[Peter Foti]

"Stephanie Stowe" <st***@whackthisvsac.org> wrote in message
news:ej**************@TK2MSFTNGP10.phx.gbl...

So my question is, can I use the ASP SessionID for my unique session
identifier? I know that they are reused. But does anyone know how and when
they are reused? The session will be maintained within the database, and
will have a mechanism for cleaning up expired sessions. So I am not trying
to key a real persistant data system on it.

I believe the server will reuse session IDs after a restart, but I'm not
certain of this. Either way, a slightly safer method would be to generate
some unique value and use that. Personally, I do it by creating a string
that is a combination of the the Session.SessionID, the date
(year,month,day,hour,minute,second), and a few random characters. This
should pretty much ensure that you'll never have any duplicates.

Regards,
Peter Foti

[Stephanie Stowe]

"Mark Schupp" <ms*****@ielearning.com> wrote in message
news:%2****************@tk2msftngp13.phx.gbl...

IIRC the ASP session id "counter" resets when the ASP application re-starts (change to global.asa, reboot, iisreset, etc). If your ASP application
always controls the session id, and it is not on a web-farm, and you clear
the session table in the database when the application restarts then you
should be ok. I would probably use an id guaranteed to be unique in the
database myself (autonumber column in Access, identity column in SQLServer)
Me too. But the DB is DB2 on the iSeries. We have been having difficulty
getting the identity BACK after an insert.

Thanks. I'll think on it.

--
Mark Schupp
Head of Development
Integrity eLearning
www.ielearning.com
"Stephanie Stowe" <st***@whackthisvsac.org> wrote in message
news:ej**************@TK2MSFTNGP10.phx.gbl...

I have been out of this group for so long, then 2 questions in one day! Let

me give some background on what I am trying to do.....

I have an IIS server running ASP apps. I have a Websphere server being a
servlet container (and a couple of other things) running java servlets and JSP. We are migrating our online services to JSP etc.. In the meantime, I am

trying to build an artifical session bridge. Imagine this...

A person logs into the Online Services (henceforth OS to reduce typing)

in ASP. For the time being, login will continue to reside within the ASP app set. They request various services; go look at their loan info, go look at their grant info, all within the ASP service set. Then they request a
service which is JSP (unbeknownst to them, of course). Off we send them to JSP land on a different server. We send over a unique identifier of the
person. At the point when they request the JSP service, I will:

-store and pass a unique session identifier in some mechanism which is
available to both JSP and ASP (a domain specific cookie with no expiry,

post

back and forth... something)
-store all session name value pairs to a database keyed on the
aforementioned unique session identifier
-pass a unique person identifier

So off they go to JSP, we can know who they are and pull there personal

info

from the database in which it is stored. When they come back, I can

rebuild

their state from the session name value pairs in the db even if the ASP
session has expired while they were gone.

So my question is, can I use the ASP SessionID for my unique session
identifier? I know that they are reused. But does anyone know how and when they are reused? The session will be maintained within the database, and
will have a mechanism for cleaning up expired sessions. So I am not trying to key a real persistant data system on it.

Thanks for the help!

S