ASP.net Pitfall

Recently we faced a strange issue in one of the production servers. The session information was shared between 2 users in the ASP.net application. We then thought to print the Session ID in the browser and was perplexed to watch that 2 different sessions printing the same session id. I then googled out to see the possibility of
a session id getting duplicated but it was never possible. Then I got a vital information in the URL below

ASP.NET page is stored in the HTTP.sys

The culprit was output caching. When enabled the cache in the ASP.net kernel stores the page along with the set cookie response in the HTTP header. This causes the same page to be redirected to different users. A weird issue is'nt it. You can get the solution in the aforesaid URL.

Browser Close Vs Session End in ASP.net

Browser Close Vs Session End in ASP.net

After a few R&D’s here goes my findings

There are n number of scenarios by which the browser can be closed viz

1. Clicking the (x) button
2. Clicking Alt+F4
3. File menu à Exit.
4. Alt+f+x

The OnUnload event will fire for all the above scenarios. So write a Javascript function like this which uses Remote scripting to Abandon the session in the Server side.

function abandonSession()
{
// Use remote scripting to
var xmlhttp;
if (window.ActiveXObject)
{ // IE
xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
xmlhttp.open("GET","AbandonSession.aspx",false);
xmlhttp.send();
}
}

Attach the above function in the HTML as shown below



In the page load of AbandonSession.aspx

protected void Page_Load(object sender, EventArgs e)
{
Session.Abandon();
// Write your code to logout the user since sometimes Session_End may not fire. Also Session_Event in Global.asax will not fire in Web farms.
}

However the weird thing is the OnUnload event also fires during following scenarios

1. When F5 or Page refresh is done
2. When the user types a different url in the same browser
3. Page is submitted or Post back happens
4. Click the browser back

So somehow you need to figure out a way which will not execute the abandonSession() function for all the above scenarios.