MVC3: C# Forms Authentication and Session State

Question

I would like to know the best way to handle and implement session time outs in MVC. I have setup my app so that it can handle the "RememberMe" when the user authenticate. I also stores some variables in Context.Session["myvar"];

I run into a problem when my session has expired but my authentication cookie has not yet expired.

My first thought was to check the session stat on on action request; but that seems like a lot of code. Is there a good place to check the session state once? What are other ways to handle a session time out? I would like the user to be redirected to the login page when a session has timedout. or have the session variables reloaded if the user is still logged in.

Darin Dimitrov · Accepted Answer · 2012-05-08 15:26:11Z

11

Is there a good place to check the session state once

Sure, a custom Authorize attribute looks like a great place:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var authroized = base.AuthorizeCore(httpContext);
        if (!authroized)
        {
            // the user is not authenticated or the forms authentication
            // cookie has expired
            return false;
        }

        // Now check the session:
        var myvar = httpContext.Session["myvar"];
        if (myvar == null)
        {
            // the session has expired
            return false;
        }

        return true;
    }
}

answered May 8, 2012 at 15:26

Darin Dimitrov

1.0m276 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Arcadian Over a year ago

how would I use the attribute? Do I place on top of every action?

Darin Dimitrov Over a year ago

Yes, you simply replace the [Authorize] attribute that you currently use with the [MyAuthorize] attribute (after obviously finding it a more meaningful name than MyAuthorize :-)).

John Zumbrum Over a year ago

As an aside, you can place this class anywhere in your project, since C# doesn't care about folders, and just replace the [Authorize] tag with [MyAuthorizeAttribute] as stated above, with an appropriate reference to the namespace.

Patrick · Accepted Answer · 2012-05-08 15:42:07Z

3

In global.asax.cs you can add SessionStart handler

protected void Session_Start(object sender, EventArgs e)
{
    if (this.Context.User != null && this.Context.User.Identity != null
        && this.Context.User.Identity.IsAuthenticated)
    {
        // Got user from authentication cookie (remember me).

        // here you can either re-instantiate user in your application/session
        // so he/she will be logged-in automatically (which is remember me functionality)
        // The username is in this.Context.User.Identity.Name

        // Or redirect user to login page if you need manual login
    }
}

answered May 8, 2012 at 15:42

Patrick

1,02713 silver badges17 bronze badges

2 Comments

Faiz Over a year ago

But anything that was stores in session variables will be lost right?

Patrick Over a year ago

@Faiz: yes it will be lost as this is start of a new session.

Collectives™ on Stack Overflow

MVC3: C# Forms Authentication and Session State

2 Answers 2

3 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related