Some ASP.NET applications use Session Variables extensively to maintain
state.
These should be re-written to use viewstate, hidden fields, querystring,
etc. instead.
This is because if a user opens a new IE window with Ctrl-N or
File-New-Window, BOTH WINDOWS SHARE THE SAME SESSION VARIABLES. This cannot
be prevented.
This means that if you change the value of a session variable in the second
window, it is also changed in the first window.
Session variables should only be used if this behavior is recognized and
compensated for.
I inherited a VB6 web class application which uses session variables
extensively. Users told me that sometimes orders were being added for the
wrong customer. I found that this occured when they opened a second browser
using Ctrl-N, changed the customer in the new window, and then returned to
the first window to add an order. They didn't realize that the customer
displayed in the first window was no longer consistent with the customer ID
stored in the shared CustomerID session variable.
Oct 19 '06
26  3615 
I agree with you on every point - I just want novice developers to know
about the trade-offs! How are they to know? This behavior is not
mentioned in any documentation I can find.
I admire your desire to see the community benefit from an understanding of
issues that may cause a web application to misbehave, or cause a security
risk. However, it is important to understand a couple of things about this:
1. A web application is, by nature, a complex and tricky application to
develop, and this is not due to .Net technology, but due to a number of
environmental factors that have existed on the WWW since long before there
*was* a .Net platform. These include the HTTP protocol, its stateless
nature, a lack of standards in user agent technology which resulted in a
large variety of user agents that behave differently in different ways, a
lack of an HTML standard, various versions of HTML, a poorly-architected
HTML standard, and a variety of extensions for HTML, such as JavaScript
(various versions) and CSS (various versions), which were also adopted in
different ways by browser and user agent vendors. Thankfully, standards are
emerging and improving rapidly, but legacy software and technology will
remain for years to come.
2. How Session cookies are handled by different user agents is only one of
many issues that a developer will encounter in web application development,
due to the issues mentioned in point 1. Dealing with the vagaries of
different user agents, how these user agents are custom-configured by the
users, different flavors of HTML, the stateless nature of HTTP, resultant
security issues, and network issues, such as dropped packets, are all issues
that contribute to the difficulty in writing solid web applications. In
other words, Session State is a very small part of the problem.
3. It is not the responsibility of Microsoft to document all of these
pre-existing non-Microsoft technologies, the various browser types (other
than Internet Explorer), web servers, and so on. It is the responsibility of
the developer to learn and understand them. Yes, this is a gargantuan task,
but if one wants to play the game, one has 2 choices: learn the game, or
lose the game.
--
HTH,
Kevin Spencer
Microsoft MVP
Short Order Coder http://unclechutney.blogspot.com
What You Seek Is What You Get
"BillE" <be****@datamti .comwrote in message
news:O1******** ******@TK2MSFTN GP03.phx.gbl...
The VS 2005 documentation clearly warns about performance issues in
ASP.NET State Management Recommendations (Disadvantage of Using Session
State), so I don't need to rave about it.
I agree with you on every point - I just want novice developers to know
about the trade-offs! How are they to know? This behavior is not
mentioned in any documentation I can find.
Thanks!
Bill
"Steve C. Orr [MVP, MCSD]" <St***@Orr.netw rote in message
news:uV******** ******@TK2MSFTN GP05.phx.gbl...
>Just because session variables are bad to use in certain situations does
not mean that they are always bad. Just like virtually every development
technique, there are trade offs that should be carefully weighed before
deciding the course on which to embark.
When I first saw the title of your post I thought you were going to rave
about what a problem session variables can be when it comes to
scalability, but you didn't even mention that.
Despite such issues, its hard to deny what a convenient development time
saver session variables can be.
--
I hope this helps,
Steve C. Orr
MCSD, MVP, CSM
http://SteveOrr.net
"BillE" <be****@datamti .comwrote in message
news:Oo******* *******@TK2MSFT NGP02.phx.gbl.. .
>>Some ASP.NET applications use Session Variables extensively to maintain
state.
These should be re-written to use viewstate, hidden fields, querystring,
etc. instead.
This is because if a user opens a new IE window with Ctrl-N or
File-New-Window, BOTH WINDOWS SHARE THE SAME SESSION VARIABLES. This
cannot be prevented.
This means that if you change the value of a session variable in the
second window, it is also changed in the first window.
Session variables should only be used if this behavior is recognized and
compensated for.
I inherited a VB6 web class application which uses session variables
extensively . Users told me that sometimes orders were being added for
the wrong customer. I found that this occured when they opened a second
browser using Ctrl-N, changed the customer in the new window, and then
returned to the first window to add an order. They didn't realize that
the customer displayed in the first window was no longer consistent with
the customer ID stored in the shared CustomerID session variable.
Between them, I think the VS documentation and MSDN do an admirable job of
addressing most, if not all, of the points you mention! Certainly HTML
issues are described fully. CSS, JavaScript, security issues, network
issues are all described.
Better documentation of this behavior of IE with respect to session
variables should also be included.
Thanks
Bill
"Kevin Spencer" <sp**@uce.govwr ote in message
news:uK******** ******@TK2MSFTN GP03.phx.gbl...
>I agree with you on every point - I just want novice developers to know
about the trade-offs! How are they to know? This behavior is not
mentioned in any documentation I can find.
I admire your desire to see the community benefit from an understanding of
issues that may cause a web application to misbehave, or cause a security
risk. However, it is important to understand a couple of things about
this:
1. A web application is, by nature, a complex and tricky application to
develop, and this is not due to .Net technology, but due to a number of
environmental factors that have existed on the WWW since long before there
*was* a .Net platform. These include the HTTP protocol, its stateless
nature, a lack of standards in user agent technology which resulted in a
large variety of user agents that behave differently in different ways, a
lack of an HTML standard, various versions of HTML, a poorly-architected
HTML standard, and a variety of extensions for HTML, such as JavaScript
(various versions) and CSS (various versions), which were also adopted in
different ways by browser and user agent vendors. Thankfully, standards
are emerging and improving rapidly, but legacy software and technology
will remain for years to come.
2. How Session cookies are handled by different user agents is only one of
many issues that a developer will encounter in web application
development, due to the issues mentioned in point 1. Dealing with the
vagaries of different user agents, how these user agents are
custom-configured by the users, different flavors of HTML, the stateless
nature of HTTP, resultant security issues, and network issues, such as
dropped packets, are all issues that contribute to the difficulty in
writing solid web applications. In other words, Session State is a very
small part of the problem.
3. It is not the responsibility of Microsoft to document all of these
pre-existing non-Microsoft technologies, the various browser types (other
than Internet Explorer), web servers, and so on. It is the responsibility
of the developer to learn and understand them. Yes, this is a gargantuan
task, but if one wants to play the game, one has 2 choices: learn the
game, or lose the game.
--
HTH,
Kevin Spencer
Microsoft MVP
Short Order Coder
http://unclechutney.blogspot.com
What You Seek Is What You Get
"BillE" <be****@datamti .comwrote in message
news:O1******** ******@TK2MSFTN GP03.phx.gbl...
>The VS 2005 documentation clearly warns about performance issues in
ASP.NET State Management Recommendations (Disadvantage of Using Session
State), so I don't need to rave about it.
I agree with you on every point - I just want novice developers to know
about the trade-offs! How are they to know? This behavior is not
mentioned in any documentation I can find.
Thanks!
Bill
"Steve C. Orr [MVP, MCSD]" <St***@Orr.netw rote in message
news:uV******* *******@TK2MSFT NGP05.phx.gbl.. .
>>Just because session variables are bad to use in certain situations does
not mean that they are always bad. Just like virtually every
development technique, there are trade offs that should be carefully
weighed before deciding the course on which to embark.
When I first saw the title of your post I thought you were going to rave
about what a problem session variables can be when it comes to
scalability , but you didn't even mention that.
Despite such issues, its hard to deny what a convenient development time
saver session variables can be.
--
I hope this helps,
Steve C. Orr
MCSD, MVP, CSM
http://SteveOrr.net
"BillE" <be****@datamti .comwrote in message
news:Oo****** ********@TK2MSF TNGP02.phx.gbl. ..
Some ASP.NET applications use Session Variables extensively to maintain
state.
These should be re-written to use viewstate, hidden fields,
querystrin g, etc. instead.
This is because if a user opens a new IE window with Ctrl-N or
File-New-Window, BOTH WINDOWS SHARE THE SAME SESSION VARIABLES. This
cannot be prevented.
This means that if you change the value of a session variable in the
second window, it is also changed in the first window.
Session variables should only be used if this behavior is recognized
and compensated for.
I inherited a VB6 web class application which uses session variables
extensivel y. Users told me that sometimes orders were being added for
the wrong customer. I found that this occured when they opened a
second browser using Ctrl-N, changed the customer in the new window,
and then returned to the first window to add an order. They didn't
realize that the customer displayed in the first window was no longer
consistent with the customer ID stored in the shared CustomerID session
variable.
Hi,
BillE wrote:
The primary issue was that the developer didn't know that Ctrl-N opened a
new window which shared the same session variables as the parent window, and
didn't code to allow for this.
I am really surprised that a developer didn't know that. It's a common
behaviour. After all, all browsers react the same, if you press Ctrl-N
in Firefox, you also get a new window in the same session.
IE is special only because it allows starting more than one process,
each of them with a different session ID (if you select the Internet
Explorer icon twice in the Start menu, for example, you start two
instances of IEXPLORE.EXE, which can easily be seen in the task
manager). Firefox doesn't react the same: It allows only one instance of
the process. So actually, the thing you should warn against is not that
two IE windows share the same session ID, but rather that in some cases,
they don't ;-)
I want to add that I recommend using the ViewState with a lot of care,
because if you don't use it carefully, you send a lot of unuseful
information back and forth on every postback. We had cases where an
uncarefully used ViewState was many KB long, which was unbearable for
our users with a modem connection. Disabling the ViewState on a control
should IMHO be the very first thing a developer does when he adds the
control to the page, and then the ViewState should be enabled on demand
only.
Every technology has drawbacks.
Greetings,
Laurent
--
Laurent Bugnion, GalaSoft
Software engineering: http://www.galasoft-LB.ch
PhotoAlbum: http://www.galasoft-LB.ch/pictures
Support children in Calcutta: http://www.calcutta-espoir.ch
Bonjour, Laurent
I think you would be surprised at the number of developers who don't know
that.
Google on "asp.net session variables ctrl+N". Lots of panicky posts and
helpful responses (and some smug responses too).
If you didn't know you needed to manage 'ctrl+N', how would you find out?
-Bill
"Laurent Bugnion" <ga*********@bl uewin.chwrote in message
news:eX******** ******@TK2MSFTN GP03.phx.gbl...
Hi,
BillE wrote:
>The primary issue was that the developer didn't know that Ctrl-N opened a
new window which shared the same session variables as the parent window,
and didn't code to allow for this.
I am really surprised that a developer didn't know that. It's a common
behaviour. After all, all browsers react the same, if you press Ctrl-N in
Firefox, you also get a new window in the same session.
IE is special only because it allows starting more than one process, each
of them with a different session ID (if you select the Internet Explorer
icon twice in the Start menu, for example, you start two instances of
IEXPLORE.EXE, which can easily be seen in the task manager). Firefox
doesn't react the same: It allows only one instance of the process. So
actually, the thing you should warn against is not that two IE windows
share the same session ID, but rather that in some cases, they don't ;-)
I want to add that I recommend using the ViewState with a lot of care,
because if you don't use it carefully, you send a lot of unuseful
information back and forth on every postback. We had cases where an
uncarefully used ViewState was many KB long, which was unbearable for our
users with a modem connection. Disabling the ViewState on a control should
IMHO be the very first thing a developer does when he adds the control to
the page, and then the ViewState should be enabled on demand only.
Every technology has drawbacks.
Greetings,
Laurent
--
Laurent Bugnion, GalaSoft
Software engineering: http://www.galasoft-LB.ch
PhotoAlbum: http://www.galasoft-LB.ch/pictures
Support children in Calcutta: http://www.calcutta-espoir.ch
dgk wrote:
On Thu, 19 Oct 2006 15:49:08 -0700, "Steve C. Orr [MVP, MCSD]"
<St***@Orr.netw rote:
>Just because session variables are bad to use in certain situations does not
mean that they are always bad. Just like virtually every development
technique, there are trade offs that should be carefully weighed before
deciding the course on which to embark.
When I first saw the title of your post I thought you were going to rave
about what a problem session variables can be when it comes to scalability,
but you didn't even mention that.
Despite such issues, its hard to deny what a convenient development time
saver session variables can be.
I'm new to ASP.NET development so I appreciate the whole thread, and
the one it descended from. I didn't realize that folks open up new
browser windows that share the session state so I will code for that.
How does IE7's tabbed windows (and Firefox) work - do those share the
session or start a new one?
Tabbed windows are always windows in the same instance of the browser,
so they will always share the same session.
The only time the windows doesn't share the same session is if they are
in separate instances of the browser, i.e. when you start a new browser
from the start menu (or similar).
Firefox only has one instance open ever. If you try to start a new
instance, a new window in the current instance is created instead, so
all windows in firefox share the same session.
On Sat, 21 Oct 2006 05:25:58 +0200, Göran Andersson <gu***@guffa.co m>
wrote:
>
Firefox only has one instance open ever. If you try to start a new
instance, a new window in the current instance is created instead, so
all windows in firefox share the same session.
That seems like a real weakness to me. I would like the option (now
that I know it exists, that is).
It's not too hard to manage this, though (although not as easy as just
populating the session variables and leaving them).
I use the solution Mark Rae mentioned -- populate the session variable when
a page is being opened, and then retrieve the session variable, stash the
value in viewstate or a hidden field, and destroy the session variable.
This also prevents inconsistent data from users using the back button.
"dgk" <dg*@somewhere. comwrote in message
news:ij******** *************** *********@4ax.c om...
On Sat, 21 Oct 2006 05:25:58 +0200, Göran Andersson <gu***@guffa.co m>
wrote:
>>
Firefox only has one instance open ever. If you try to start a new
instance, a new window in the current instance is created instead, so
all windows in firefox share the same session.
That seems like a real weakness to me. I would like the option (now
that I know it exists, that is).
This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics | |
by: Jake Lloyd |
last post by:
In "A Note on Security In PHP" (partly in reference to a security flaw
that exists or recently did exist in phpBB) at
http://nl3.php.net/security-note.php
The PHP Group makes this claim:
"Every remote exploit can be avoided with very careful input validation."
This is very reassuring, if it is true, and it gives much to be said in
favor of implementing PHP in applications that accept remote user input.
But is it true?
One rarely sees an...
|
by: patel |
last post by:
Hello,
I get this warning with my PHP code sometimes. It will come up, and
then after reloading the page once or twice, it will go away. Any
ideas? The code is below:
Warning: Unknown: Your script possibly relies on a session side-effect
which existed until PHP 4.2.3. Please be advised that the session
extension does not consider global variables as a source of data,
unless register_globals is enabled. You can disable this functionality...
|
by: tshad |
last post by:
I have been using the default session state (InProc) and have found that I
have been loosing my information after a period of time (normally 20
minutes).
Is there anyway to find out how much more time I have on a session?
If I do a refresh, does reset the session clock?
Do you have have to go to another page to reset the session timeout or will
a postback also do it? This is important as we have a few pages that a user
|
by: lawrence k |
last post by:
How can I find out where my script is outputting to the screen for the
first time?
My error logs are full of stuff like this:
PHP Warning: session_start(): Cannot send
session cache limiter - headers already sent in
/home/httpd/vhosts/monkeyclaus.org/httpdocs/media/audio/pdsIncludes/CommandStartSession.php
on line 14
|
by: Atul Shukla |
last post by:
Hi,
How can I avoid application timeout? Generally a web application time out is
20 minutes, however, we can define this timeout in web.config to any number
of minutes. After giving 500 minutes of time out which is about little more
than 8 hours, the page expires in less than 2 hours. I am confused here how
to avoid this timeout problem.
I just dont want my page to be expired, should work similar to windows
application.
Possible?
| | |
by: mcserret |
last post by:
I know this is a recurring problem that has been addressed here
before, but even after reading all that has gone before, I am still
stumped.
I have a form that is designed to send data to a PHP page where is is
to be validated then read into a MySQL table. Once that is done, the
form is to send the user either back to the originating page, or to a
logout page.
I have several versions of this setup on my site that work well, so
|
by: Jeff |
last post by:
I turned on errors in php:
ini_set('display_errors','1');
And I got a slew of notices and a couple of warnings.
The notices are mostly missing indexes from doing things like this:
$some_var = $_REQUEST;
|
by: anithaapr05 |
last post by:
I have got the warning in event viewer when i wrote the code in global.asax session_end().
When the user sessions time out, the Session_End event fires successfully.But i got the waring in event viewer.
My Waring is
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 8/14/2009 3:04:16 PM
|
by: anithaapr05 |
last post by:
After the session end i try to write the session value.In this, it write the session value after the session end, but i got the warning in application event.
My asp code:
void Session_End(object sender, EventArgs e)
{
// Code that runs when a session ends.
// Note: The Session_End event is raised only when the sessionstate mode
// is set to InProc in the Web.config file. If session mode is set to...
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look !
Part I. Meaning of...
|
by: Hystou |
last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it.
First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
| | |
by: Oralloy |
last post by:
Hello folks,
I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>".
The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed.
This is as boiled down as I can make it.
Here is my compilation command:
g++-12 -std=c++20 -Wnarrowing bit_field.cpp
Here is the code in...
|
by: tracyyun |
last post by:
Dear forum friends,
With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
|
by: agi2029 |
last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own....
Now, this would greatly impact the work of software developers. The idea...
|
by: isladogs |
last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM).
In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules.
He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms.
Adolph will...
|
by: conductexam |
last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one.
At the time of converting from word file to html my equations which are in the word document file was convert into image.
Globals.ThisAddIn.Application.ActiveDocument.Select();...
|
by: muto222 |
last post by:
How can i add a mobile payment intergratation into php mysql website.
| | |
by: bsmnconsultancy |
last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...
| |
