Session Expired in Asp.Net MVC 2

Question

Some users close all the browsers and they open IE8 again and they get the message "Session Expired" in the login page, which is strange, and it only happens sometimes.

The conditions to show that message are:

var sessionTimedOut = Session.IsNewSession && Request.Headers["Cookie"] != null && Request.Headers["Cookie"].Contains(ASPNET_SESSION_COOKIE);

And normally all cookies disapear when the browser is closed, because that is the scope of these cookies.

So what could be causing this condition to be true?

Edit: I could replicate the issue by waiting the session to expire, then killing the browser on Task Manager, then opening the browser and going explicitly to the login page (myserver.com/Web/Authentication/Login), but I don't believe my users are killing the browser - I believe they don't even know how to do that.... — Miguel Domingos
– Miguel Domingos, Commented May 8, 2014 at 14:11
it might be related to specific IE8 behavior stackoverflow.com/questions/1324181/…. Can you ask your users what actions exactly they are doing? — jan salawa
– jan salawa, Commented May 15, 2014 at 14:33
Just a guess, If you are using form authentication set cookie to persistent. — chandresh patel
– chandresh patel, Commented May 20, 2014 at 9:32
If you are able to reproduce it, then maybe use a tool like Fiddler to examine the HTTP request and see how the session id is being passed back to the server (ie. cookies, url, http header). Take a look at ASP.NET State Management for some things to look for. — Mr Moose
– Mr Moose, Commented May 21, 2014 at 4:39

brainless coder · Accepted Answer · 2014-05-21 09:32:43Z

1

Are you saving the value ASPNET_SESSION_COOKIE yourself into the session?...or just relying on ASP.net built in sessions handler? If you are not saving by yourself, then the following scenario might have been causing the problem.

I think your condition is not properly configured to check for expired sessions.The reasons are -

ASP.Net by default saves Sessions, in Cookie, Therefore whenever a new session is created so does the Cookie.
Lets, consider the scenario, that a session has expired, then when the request is made (that is the GET for the Login page) ASP.net is checking for a Cookie or Session and sees that it needs a new session to be created. Therefore, it creates a Session and saves the cookie.
Again, lets consider, this is the first time some one sees the page, again, the same thing will happen as 2. The condition is always true.
You need to save some custom Cookie/Session values inside the cookie/session so that you can check agains it.

I am highly suspicious that, the condition -

Session.IsNewSession && Request.Headers["Cookie"] != null && Request.Headers["Cookie"].Contains(ASPNET_SESSION_COOKIE);

is never false, Unless you are using or checking this, before the session is handled or checked by ASP.Net.

answered May 21, 2014 at 9:32

brainless coder

6,4501 gold badge23 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Miguel Domingos Over a year ago

Let me explain better: This is the Login GET action of my LoginController.

Miguel Domingos Over a year ago

When starting a new IE8 when all other browsers were closed Session.IsNewSession is true and Request.Headers["Cookie"].Contains(ASPNET_SESSION_COOKIE) is false, so I just present the Login form to the user.

Miguel Domingos Over a year ago

If I start IE8, login, wait for the session and authentication/forms expiration, open a new IE8 on the login action, then: Session.IsNewSession is true and Request.Headers["Cookie"].Contains(ASPNET_SESSION_COOKIE) is true, so I'm wrongly showing on that new window that the session has expired

Miguel Domingos Over a year ago

Now what contraditcs your theory: If I start IE8, login, wait for the session and authentication/forms expiration, CLOSE ALL BROWSERS, open a new IE8 on the login action, then: Session.IsNewSession is true and Request.Headers["Cookie"].Contains(ASPNET_SESSION_COOKIE) is false, so I'm not showing any timeout message on the Login View.

Collectives™ on Stack Overflow

Session Expired in Asp.Net MVC 2

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related