Session variables timing out too soon in ASP 2.0

[emajka21]

I created a website in ASP 2.0/c# that connects to an Access 2000 database. Currently I have 4 pages that people can view without logging in, which are reports that post marathon race results. Only one maybe two people will actually ever have to log in to enter the race data.

For the login I created a form that asks for user name and password. Then I do a sql query to see if that matches the information in the database. If it does it grabs their role which would be admin.

Here is my code for this:

    protected void Button1_Click(object sender, EventArgs e)
    {
        if (txtUser.Text != "" && txtPassword.Text != "")
        {
            OleDbConnection conn = new OleDbConnection("Provider=Microsoft.Jet.OLEDB.4.0;data source=" + Server.MapPath("~/App_Data/pfrpc.mdb"));
            OleDbCommand cmd = new OleDbCommand("select RunnerID, Role from Runner WHERE UserName = @UserName and Pass = @Password", conn);
 
            cmd.Parameters.Add("@UserName", OleDbType.VarChar, 50);
            cmd.Parameters["@UserName"].Value = txtUser.Text;
            cmd.Parameters.Add("@Password", OleDbType.VarChar, 50);
            cmd.Parameters["@Password"].Value = txtPassword.Text;
 
            conn.Open();
 
            OleDbDataReader reader = cmd.ExecuteReader();
            string test = "";
            if (reader.Read())
            {
                Session["userRole"] = reader["Role"];
                Session["RunnerID"] = reader["RunnerID"];
 
                test = Session["userRole"] + "";
 
 
                if (test == "admin")
                {
                    Response.Redirect("RaceTimes.aspx");
                }
 
            }
            else
            {
                lblError.Text = "Invalid Login";
            }
            reader.Close();
            conn.Close();
 
        }
        else
        {
            lblError.Text = "You must fill in both the username and password fields";
        }
 
    }
 

Once the session variable is equal to admin the other pages become available. By default in all of the admin pages the controls are not visible and if the session variable is equal to admin it will make the items visable. Here is a sample of one of the pages:

        string test = Session["UserRole"] + "";
 
        //verifies if user logged in
 
        if (test == "admin")
        {
            txtMinutes.Visible = true;
            txtSeconds.Visible = true;
            txtYear.Visible = true;
            ddlBibNum.Visible = true;
            ddlRace.Visible = true;
            lblBibNum.Visible = true;
            lblMinutes.Visible = true;
            lblSeconds.Visible = true;
            lblYear.Visible = true;
            lblRaceNum.Visible = true;
            btnSave.Visible = true;
 
        }
        else
        {
            lblError.Text = "You must login to have access to this page!";
        }
 

Anyways this works on my pc through development but after I put these files on a server (which is on a free hosting server that I am using for testing) it times out really fast. After about 30 seconds to a minute my session loses that it is an admin and the pages tell me that I am not an admin anymore. Any thoughts on this? Are session variables the best way to go in this case? Hopefully I provided enough code for you to have an understanding of what I am trying to do. Any help would be much appreciated!

Thanks!

[TRScheel]

Curiously, do you ever set the timeout on the Session?

[emajka21]

No, I'm not sure how to do that. Where do I set that? In the web.config?

[TRScheel]

No, I'm not sure how to do that. Where do I set that? In the web.config?

The session object itself should have a timeout property

[Plater]

No, I'm not sure how to do that. Where do I set that? In the web.config?

Some session timeout settings are in the IIS settings for the web-application itself.

[emajka21]

Well I had time to play with it a bit more. It seems that if I stay in the same page and add data (while refreshing and clearing the form after the data is saved)the session doesn't time out. It seems to loose the session variable when I go from page to page. It has to be the way I coded the pages. Any thoughts on this?

[emajka21]

Well I have to change that theory again. After more testing I have found that the pages are timing out. It is just the form because visible and I didn't have them to turn back to invisible if the user wasn't an admin.

At least I found one flaw....

I also emailed my host provider to ask about their servers... Lets see what they say. Does anyone have any other suggestion other then session variables?

[Plater]

Are you set to use "InProc" as your seesion mode?

[emajka21]

Umm I'm not sure. I am using what ever is default for session variables. Here is my web.config:

<?xml version="1.0"?>
 
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
 
    <pages theme ="purple" />
 
        <compilation debug="true"/>
 
        <authentication mode="Windows"/>
 
 
 
    <siteMap defaultProvider="AspNetXmlSiteMapProvider" enabled="true">
 
      <providers>
 
        <add siteMapFile="~\web.sitemap" name="MyXmlSiteMapProvider" type="System.Web.XmlSiteMapProvider"/>
        <add siteMapFile="~\web2.sitemap" name="MyXmlSiteMapProvider2" type="System.Web.XmlSiteMapProvider"/>
      </providers>
 
    </siteMap>
 
 
  </system.web>
</configuration>

[Frinavale]

Anyways this works on my pc through development but after I put these files on a server (which is on a free hosting server that I am using for testing) it times out really fast. After about 30 seconds to a minute my session loses that it is an admin and the pages tell me that I am not an admin anymore. Any thoughts on this? Are session variables the best way to go in this case? Hopefully I provided enough code for you to have an understanding of what I am trying to do. Any help would be much appreciated!

Thanks!

I know this wont help you to understand your Session Time out issues....

But Since you've ask if Session variables are the best way to go in this case I'm going to suggest you use something completely different.

Since you're using .NET 2.0 framework there are tools available to you that simplify the user authentication and authorization process.

Check out this video first.

Then I'd suggest looking into the information provided by MSDN on the following:

• Forms Authentication
• Membership
• and Role Management

The video was taken from a website that contains a lot of useful information on the topic:this website is found here.


I hope this helps you out!

-Frinny

[Plater]

The Session Timeout and InProc settings are in the IIS management controls, which, you probably don't have access to since you're hosted.
Check with your host, and if they're not already there, have them set the Session Timeout to like 15-20mins (or whatever) and make sure it's set to "InProc".
That might not help, but it's good to check.

My settings:
Session State Mode: "InProc"
Cookieless mode: "UseCookies"
Session Timeout(inutes): "20"


Hmm, is your session cookie being set and passed correctly between pages? That could cause the problem you are seeing as well.

[emajka21]

Hello again,
Thanks for everyone's help on this. I contacted the host provider and got a generic message stating to check the tech support page which sucks. So I replied with a more specific question. Lets see if they get back to me with a real answer or not.

Either way I plan on looking into the form authentication this weekend. I have other things going on that I can't spend alot of time on it until then. If I run into anymore problems I will post again.

Thanks!

[emajka21]

Well I sort of got the form authentication working except for 1 thing. My sitemaps. I have 2 sitemaps, 1 for anyone and 1 for admins. I don't want the admin sitemap to be visible until the admin logs in. I read to do this I could use securityTrimmingEnabled="true". This does hide the second sitemap but it doesn't bring it back when I log in. I don't know what I am doing wrong here. I know my security is working because if I take out that line the site map appears and if those links are clicked it redirects to the login page. Once logged in those pages are accessible. Any thoughts?

Here is my webconfig:

<?xml version="1.0"?>
 
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
        <roleManager enabled="true" />
  <pages theme="purple"/>
 
        <compilation debug="true">
            <assemblies>
                <add assembly="System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
                <add assembly="System.Security, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
                <add assembly="Accessibility, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
                <add assembly="System.Runtime.Serialization.Formatters.Soap, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/>
                <add assembly="System.Deployment, Version=2.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/></assemblies></compilation>
 
        <authentication mode="Forms" />
 
 
        <siteMap defaultProvider="AspNetXmlSiteMapProvider" 
    enabled="true">
            <providers>
                <add siteMapFile="~\web.sitemap" name="MyXmlSiteMapProvider" type="System.Web.XmlSiteMapProvider"  />
        <add siteMapFile="~\web2.sitemap" name="MyXmlSiteMapProvider2" type="System.Web.XmlSiteMapProvider"  />
 
      </providers>
        </siteMap>
 
 
    </system.web>
</configuration>
 

Here are my sitemaps (admin):

<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
    <siteMapNode url="" title=""  description="">
 
      <siteMapNode url="admin\ChangePassword.aspx" title="Change Password"  description="Change User Name or Password" />
      <siteMapNode url="admin\NewRunner.aspx" title="New Runner"  description="Add New Runners" roles="Administrator"/>
      <siteMapNode url="admin\UpdateRunner.aspx" title="Update Runner"  description="Update Runner information" roles="Administrator"/>
      <siteMapNode url="admin\RaceTimes.aspx" title="Enter Race Times"  description="Enter Race Times" roles="Administrator"/>
      <siteMapNode url="admin\EditTimes.aspx" title="Edit Race Times"  description="Edit Current Year Race Times" roles="Administrator"/>
      <siteMapNode url="admin\RegisterRunner.aspx" title="Register Runners"  description="Register Runners for the year" roles="Administrator"/>
      <siteMapNode url="admin\RegisteredRunners.aspx" title="List of Registered Runners"  description="List of Registered Runners" roles="Administrator"/>
 
 
    </siteMapNode>
</siteMap>
 

NON ADMIN:

<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
    <siteMapNode url="" title=""  description="">
 
      <siteMapNode url="age.aspx" title=" Race Times by Sex/Age"  description="Report of Race times sorted first by Sex, then Age groups" />
      <siteMapNode url="individual.aspx" title="Individual Race Times"  description=" Race Times for each individual runner" />
      <siteMapNode url="Overall.aspx" title="All Marathon Totals"  description="Report of overall Marathon Progress" />
      <siteMapNode url="OverallbyAge.aspx" title="Marathon Totals by Sex/Age"  description="Report of overall Marathon Progress by Sex/Age" />
      <siteMapNode url="http://www.pfrpc.com"  title="PFPRC Home"  description="Park Forest Running and Pancake Club Home Page" target="_blank"/>
      <siteMapNode url="http://www.pfrpc.com/about-us.html"  title="About PFPRC"  description="About the Park Forest Running and Pancake Club" target="_blank"/>
      <siteMapNode url="http://www.pfrpc.com/contact-us.html"  title="Contact Us"  description="Contact the PFRPC" target="_blank"/>
 
 
    </siteMapNode>
</siteMap>
 

HERE IS MY MASTERPAGE:

<%@ Master Language="C#" AutoEventWireup="true" CodeFile="MasterPage.master.cs" Inherits="test" %>
 
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 
<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>Untitled Page</title>
</head>
<body>
    <form id="form1" runat="server">
    <!-- Header -->
    <div class="Header">
        <asp:Image ID="Image1" runat="server" ImageUrl="~/images/title.png" AlternateText="PFRPC Progressive Marathon" Width="750px" />&nbsp;<br />
 
    </div>
 
    <!--Menu-->
   <div class="Menu">
   <asp:SiteMapDataSource id="NotLoggedInSiteMap" runat="server" ShowStartingNode="false" SiteMapProvider="MyXmlSiteMapProvider2"  />
       <asp:HyperLink ID="hlHome" runat="server" NavigateUrl="~/Default.aspx">Home</asp:HyperLink><br />
       <asp:HyperLink ID="hlLogin" runat="server" NavigateUrl="~/login.aspx">Admin Login</asp:HyperLink>
       <asp:HyperLink ID="hlLogout" runat="server" NavigateUrl="~admin/LogoutSuccess.aspx" Visible="False">Logout</asp:HyperLink>
   <asp:Menu ID="NotLoggedInMenu" runat="server" DataSourceID="NotLoggedInSiteMap" OnMenuItemDataBound="NotLoggedInMenu_MenuItemDataBound">
 
        </asp:Menu>
   </div>     
 
   <!-- Menu -->
   <div class="Menu2">
   <asp:SiteMapDataSource id="LoggedInSiteMap" runat="server" ShowStartingNode="false" SiteMapProvider="MyXmlSiteMapProvider"  />
   <asp:Menu id="LoggedInMenu" runat="server"  DataSourceID="LoggedInSiteMap" Visible="true" ></asp:Menu>
       &nbsp;&nbsp;
 
   </div>
 

MASTERPAGE CODE BEHIND:

public partial class test : System.Web.UI.MasterPage
{
    protected void Page_Load(object sender, EventArgs e)
    {
 
    }
 
    protected void NotLoggedInMenu_MenuItemDataBound(object sender, MenuEventArgs e)
    {
 
        e.Item.Target = ((SiteMapNode)(e.Item.DataItem))["target"];
    }

[emajka21]

Never mind. I think I got it working. The next step is to upload it to the server and see if it works!

[emajka21]

Well I uploaded it to the server and it isn't working. This is quite frustrating!

When I go to log in I just get an application runtime error. Any thoughts on why??

I am going to email them back about this.

This was the web hosts answer:
Dear Customer,

Thank you for your inquiry regarding your account(s).

Free sites are hosted in busy environment. They are
hosted in Application pools where many others sites
are hosted too. The application pools have a limit on
amount of memory they can use. After reaching the
memory limit application pool will recycle causing a
reset of session variables among other things.
If sites that have a memory leaks are hosted with your
site in the same application pool you'll experience a
problem you've described.
Without complicated investigation we cannot detect a
sites with severe memory leaks. An we do not
investigate this sort of problems on our servers with
free hosting plans.
There are however many web servers with hundreds of
application pools where you can host you site.

To workaround the issue: Delete your site wait 5
minutes, and then register it again.
-----------------------------------------------

I guess I can try that but after getting form validation to work I see how much nicer and secure it is. I don't want to go back...

Any thoughts or suggestions would be much appreciated!

[emajka21]

Never mind, I think I figured it out. Since using the form authentication creates a sql database I think that is my problem. My free webhost doesn't support sql databases, only access databases.. Fun...

Thanks for the help!

[Frinavale]

Never mind, I think I figured it out. Since using the form authentication creates a sql database I think that is my problem. My free webhost doesn't support sql databases, only access databases.. Fun...

Thanks for the help!

That's to bad about the database.
You can customize your Forms Authentication to not use a database by creating a custom Membership object.

Or

More simply you could use the web.config file to store your user information instead of a database!