Session variables timing out too soon in ASP 2.0

[emajka21]

I created a website in ASP 2.0/c# that connects to an Access 2000 database. Currently I have 4 pages that people can view without logging in, which are reports that post marathon race results. Only one maybe two people will actually ever have to log in to enter the race data.

For the login I created a form that asks for user name and password. Then I do a sql query to see if that matches the information in the database. If it does it grabs their role which would be admin.

Here is my code for this:

    protected void Button1_Click(object sender, EventArgs e)
    {
        if (txtUser.Text != "" && txtPassword.Text != "")
        {
            OleDbConnection conn = new OleDbConnection("Provider=Microsoft.Jet.OLEDB.4.0;data source=" + Server.MapPath("~/App_Data/pfrpc.mdb"));
            OleDbCommand cmd = new OleDbCommand("select RunnerID, Role from Runner WHERE UserName = @UserName and Pass = @Password", conn);
 
            cmd.Parameters.Add("@UserName", OleDbType.VarChar, 50);
            cmd.Parameters["@UserName"].Value = txtUser.Text;
            cmd.Parameters.Add("@Password", OleDbType.VarChar, 50);
            cmd.Parameters["@Password"].Value = txtPassword.Text;
 
            conn.Open();
 
            OleDbDataReader reader = cmd.ExecuteReader();
            string test = "";
            if (reader.Read())
            {
                Session["userRole"] = reader["Role"];
                Session["RunnerID"] = reader["RunnerID"];
 
                test = Session["userRole"] + "";
 
 
                if (test == "admin")
                {
                    Response.Redirect("RaceTimes.aspx");
                }
 
            }
            else
            {
                lblError.Text = "Invalid Login";
            }
            reader.Close();
            conn.Close();
 
        }
        else
        {
            lblError.Text = "You must fill in both the username and password fields";
        }
 
    }
 

Once the session variable is equal to admin the other pages become available. By default in all of the admin pages the controls are not visible and if the session variable is equal to admin it will make the items visable. Here is a sample of one of the pages:

        string test = Session["UserRole"] + "";
 
        //verifies if user logged in
 
        if (test == "admin")
        {
            txtMinutes.Visible = true;
            txtSeconds.Visible = true;
            txtYear.Visible = true;
            ddlBibNum.Visible = true;
            ddlRace.Visible = true;
            lblBibNum.Visible = true;
            lblMinutes.Visible = true;
            lblSeconds.Visible = true;
            lblYear.Visible = true;
            lblRaceNum.Visible = true;
            btnSave.Visible = true;
 
        }
        else
        {
            lblError.Text = "You must login to have access to this page!";
        }
 

Anyways this works on my pc through development but after I put these files on a server (which is on a free hosting server that I am using for testing) it times out really fast. After about 30 seconds to a minute my session loses that it is an admin and the pages tell me that I am not an admin anymore. Any thoughts on this? Are session variables the best way to go in this case? Hopefully I provided enough code for you to have an understanding of what I am trying to do. Any help would be much appreciated!

Thanks!

[TRScheel]

Curiously, do you ever set the timeout on the Session?

[emajka21]

No, I'm not sure how to do that. Where do I set that? In the web.config?

[TRScheel]

No, I'm not sure how to do that. Where do I set that? In the web.config?

The session object itself should have a timeout property

[Plater]

No, I'm not sure how to do that. Where do I set that? In the web.config?

Some session timeout settings are in the IIS settings for the web-application itself.

[emajka21]

Well I had time to play with it a bit more. It seems that if I stay in the same page and add data (while refreshing and clearing the form after the data is saved)the session doesn't time out. It seems to loose the session variable when I go from page to page. It has to be the way I coded the pages. Any thoughts on this?

[emajka21]

Well I have to change that theory again. After more testing I have found that the pages are timing out. It is just the form because visible and I didn't have them to turn back to invisible if the user wasn't an admin.

At least I found one flaw....

I also emailed my host provider to ask about their servers... Lets see what they say. Does anyone have any other suggestion other then session variables?

[Plater]

Are you set to use "InProc" as your seesion mode?

[emajka21]

Umm I'm not sure. I am using what ever is default for session variables. Here is my web.config:

<?xml version="1.0"?>
 
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
 
    <pages theme ="purple" />
 
        <compilation debug="true"/>
 
        <authentication mode="Windows"/>
 
 
 
    <siteMap defaultProvider="AspNetXmlSiteMapProvider" enabled="true">
 
      <providers>
 
        <add siteMapFile="~\web.sitemap" name="MyXmlSiteMapProvider" type="System.Web.XmlSiteMapProvider"/>
        <add siteMapFile="~\web2.sitemap" name="MyXmlSiteMapProvider2" type="System.Web.XmlSiteMapProvider"/>
      </providers>
 
    </siteMap>
 
 
  </system.web>
</configuration>

[Frinavale]

Anyways this works on my pc through development but after I put these files on a server (which is on a free hosting server that I am using for testing) it times out really fast. After about 30 seconds to a minute my session loses that it is an admin and the pages tell me that I am not an admin anymore. Any thoughts on this? Are session variables the best way to go in this case? Hopefully I provided enough code for you to have an understanding of what I am trying to do. Any help would be much appreciated!

Thanks!

I know this wont help you to understand your Session Time out issues....

But Since you've ask if Session variables are the best way to go in this case I'm going to suggest you use something completely different.

Since you're using .NET 2.0 framework there are tools available to you that simplify the user authentication and authorization process.

Check out this video first.

Then I'd suggest looking into the information provided by MSDN on the following:

• Forms Authentication
• Membership
• and Role Management

The video was taken from a website that contains a lot of useful information on the topic:this website is found here.


I hope this helps you out!

-Frinny