Losing Session state

[Arthur Dent]

Hello all, I have some issue which is driving me crazy in testing my site...

Every now and then, the session variables in my site all get cleared out. I
assume this is because of something causing the AppPool to recycle.
The thing that really throws a wrench into all this though, is that after
the app recycles, User.Identity.IsAuthenticated is still returning true!
So despite the fact that the session and all its information is gone, and
effectively destroyed, the app is still reporting that the user is logged
in.
How can I either get it to stop recycling, or to sign the user out along
with the recycle?????

Thanks in advance,
- Arthur Dent.

[Teemu Keiski]

Hi,

if your application uses InProc session state, that indeed is wiped out when
application pool recycled. And especually in ASP.NET 2.0 or better apppool /
application restarts can occur quite easily (a few changes to files, change
in web.config, adding new dlls to bin etc etc). Therefore it's best to use
out-of-process session state modes such as SQL Server or State Server

http://msdn.microsoft.com/en-us/library/ms178586.aspx

--
Teemu Keiski
AspInsider, ASP.NET MVP
http://blogs.aspadvice.com/joteke
http://teemukeiski.net

"Arthur Dent" <hi*********************@yahoo.comwrote in message
news:2D**********************************@microsof t.com...

Hello all, I have some issue which is driving me crazy in testing my
site...

Every now and then, the session variables in my site all get cleared out.
I assume this is because of something causing the AppPool to recycle.
The thing that really throws a wrench into all this though, is that after
the app recycles, User.Identity.IsAuthenticated is still returning true!
So despite the fact that the session and all its information is gone, and
effectively destroyed, the app is still reporting that the user is logged
in.
How can I either get it to stop recycling, or to sign the user out along
with the recycle?????

Thanks in advance,
- Arthur Dent.

[Peter Bromberg [C# MVP]]

Depending on what type of authentication your site uses (Forms auth, for
example), this does not depend on Session State at all. Forms auth has a
forms ticket in the form of a cookie that is read by the forms
authentication provider on each page request. If the cookie is there, you
are authenticated. Nothing to do with Session at all.
Peter

"Arthur Dent" <hi*********************@yahoo.comwrote in message
news:2D**********************************@microsof t.com...

Hello all, I have some issue which is driving me crazy in testing my
site...

Every now and then, the session variables in my site all get cleared out.
I assume this is because of something causing the AppPool to recycle.
The thing that really throws a wrench into all this though, is that after
the app recycles, User.Identity.IsAuthenticated is still returning true!
So despite the fact that the session and all its information is gone, and
effectively destroyed, the app is still reporting that the user is logged
in.
How can I either get it to stop recycling, or to sign the user out along
with the recycle?????

Thanks in advance,
- Arthur Dent.

[Moe Sisko]

"Arthur Dent" <hi*********************@yahoo.comwrote in message
news:2D**********************************@microsof t.com...

>
.. or to sign the user out along with the recycle?????

You might find this article helpful :

http://www.abstraction.net/content/a...%20asp.net.htm

So, in the Session_Start event, once a new session is detected, you could
call :

FormsAuthentication.SignOut( ); to logout, if you are using forms
authentication.

Also note that the code shown in the Session_Start event has a potential
problem - if a user was on the Login page when session expired, it will
redirect back to the Login page, which is not necessary. So you could check
the page of the current request, and not perform the redirect if you are
already on the login page.

HTH,
Moe

[Arthur Dent]

This seems like the best approach. I'm kind of working this direction now,
but your post helped clarify and clean up the logic I was using.
The article also is a very good discussion.

Thanks for the help!! CheerZ

"Moe Sisko" <nullwrote in message
news:#o**************@TK2MSFTNGP04.phx.gbl...

>
"Arthur Dent" <hi*********************@yahoo.comwrote in message
news:2D**********************************@microsof t.com...

>>
.. or to sign the user out along with the recycle?????

You might find this article helpful :

http://www.abstraction.net/content/a...%20asp.net.htm

So, in the Session_Start event, once a new session is detected, you could
call :

FormsAuthentication.SignOut( ); to logout, if you are using forms
authentication.

Also note that the code shown in the Session_Start event has a potential
problem - if a user was on the Login page when session expired, it will
redirect back to the Login page, which is not necessary. So you could
check the page of the current request, and not perform the redirect if you
are already on the login page.

HTH,
Moe