2

I have an asp.net c# web application where a user can log in and see his schedule for the last week, which is stored in a remote database. Logging into the site consists of just an SQL check to see if the username and password matches the uname & pass records in the database. Once logged in, they can manipulate the time entries for the schedule, etc. While debugging, I logged in as two different users. User B had all of user A's stuff on his form. I wrote the program like I was writing a regular c# app, and didn't really give any thought to multiple people using the website at the same time. I guess I thought that instance handling would be automatic? I've only been working with asp.net for a week or so, and don't have much support.

My main question is, if I have multiple users on my site at the same time, how do I keep their sessions separate?

update - after adding Session variables

This is my sql statement to get user information. Now, using session variables:

string sqlquery = "SELECT FirstName, LastName, OperatorID FROM operators WHERE EmpID = '" + sql + "'";
        using (MySqlConnection conn = new MySqlConnection(ConfigurationManager.ConnectionStrings["EobrConnectionString"].ConnectionString))
        {
            conn.Open();
            using (MySqlCommand comm = new MySqlCommand(sqlquery, conn))
            {
                using (MySqlDataAdapter adapter = new MySqlDataAdapter(comm))
                {
                    DataTable dt = new DataTable();
                    adapter.Fill(dt);
                    foreach (DataRow dr in dt.Rows)
                    {
                        Session["Fname"] = dr[1].ToString();
                        Session["Lname"] = dr[2].ToString();
                        Session["opID"] = dr[3].ToString();
                     }
                }
            }
        }

In the main menu page I have this:

protected void Page_Load(object sender, EventArgs e)
{
    firstname = Session["Fname"].ToString();
    lastname = Session["Lname"].ToString();
    lblwelcome.Text = "Welcome, " + firstname + " " + lastname + ", make your selection below.";
}

When User A logs in, they see their name "Frank Drebbin". When User B logs in they see their name, "Jake Gaston". But now, if I reload the first users page, they see the name as "Jake Gaston".

Improve this question
3
  • It could be as simple as including a username parameter in your sql query. Show some code and I can try to help. Commented May 23, 2012 at 16:44
  • How are you logging users in to your site now, FormsAuth? Sessions are seperate from each other in terms of the data you choose to store BUT if you're not including a user identifier like UserID or UserName when performing your SELECT statments in SQL then you need to go back and do that. Commented May 23, 2012 at 16:53
  • I think the best way to track the record of the user if you save the session as well in the DB.When you log in, at first return the session value against the user's last entry, if the user and the session matched, that means the user is still in the session.through this approach, if you want to stop the user enter two different machines, you can. Commented Apr 30, 2018 at 4:56

4 Answers 4

Reset to default
5

You need to use seperate browsers. You're using sessions to identify users, and sessions are matched to a cookie in your browser From your comments above, here's what happens

log in as steve -> session created -> steve stored as username -> cookie returned to browser

in a new window, log in as frank -> session already exists, rename username to frank.

in 1st window refresh. -> session username no frank -> return data based on that username.

New IE windows all share the same context. this means if 1 window gets a cookie, they all do. There are 2 ways around this (actually 3).

  • Use physically different machines
  • Use 2 broswers, eg IE & Firefox
  • In IE press alt to get the menu, then click new session from the file menu. This makes a physically separate window that won't share cookies (although there's nothing to indicate this to you)

Having done the above, try again logging in as Steve & Frank & you should see they don't interfere with each other.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

Oh, I guess I should have known that :s. It works, and thanks a lot!
2

I would guess the problem is that, while the sessions are kept separately (you are storing things in Session, right?), the queries that load data from the database are not taking the username into account.

Have a look at the SQL query that loads tasks and see if you include the username (or a user ID) in that query. Feel free to post the query if you need help looking at it.

So to directly answer your main question, if you store things in Session, they will be properly isolated from other sessions. However, wrong data in, wrong data out.

Improve this answer

3 Comments

If I were passing data between the login and schedule page like this: Response.Redirect("MainMenu.aspx?empID=" + this.txtEmpID.Text + "&FirstName=" + Fname + "&LastName=" + Lname + "&opID=" + opID); and not storing them as a session variable, is that my problem?
Thats not secure in any way, all of the variables, including the UserID, are in the query string. Remove them and you're not logged in, edit and it now you're a different user. I suggest looking in to Forms Authentication and creating a real login and then go back and fix your SQL queries to include the UserID
I guess I don't get it. I removed the query redirect data and added some session variables like this one, (Session["username"] = txtUsername.Text) to the application, but user A logs in and sees his name, "Frank", then user B logs in and sees his name "Steve", I can refresh the user A page and now the name is "Steve".
0

EDIT: Use another browser to test this, you can't use the same browser in another tab, or the same browser in another window, it almost will be the same session

If you are using "Session" to save user's data then they are separated, that means you should store any per-user data into "Session" or cookies.

NOTE: You should maintain concurrency http://msdn.microsoft.com/en-us/library/cs6hb8k4(v=vs.80).aspx

Improve this answer

3 Comments

How is this related at all to concurrency? That would be the case if two people logged in that SHOULD have access to the same rows both try to update those rows at the same time.
The issue is nothing to do with concurrency. Also explaining how you "maintain concurrency" would have been more helpful
The question was not clear enough to answer him in your correct way, please remove the -1 please.
0

The solution is very simple( USER DIFFERENT BROWSERS SIMONTANIOUSLY) like IE, Firefox, Chrome etc........

You are not using transact SQL so need to bother about concurrency,

but when u login the current browser create a session if you use the same browser it will still has that session,

If you use another browser the browser will have the session but the value wont be the same.

e.g.

Each mobilephones have different browsers now if you have 100 mobile phones that would mean you can store 100 same USER session but all will have different values varies on the data you providing or operation handles.

Hope this help you understand.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.