Hi,
My web application uses SQL Server for StateManagement.
I have two problems because of this:
1. The session-id is part of url. Therefore if we copy and paste this url in a new browser, I continue to work with the older session. This is a huge security threat, please help.
2. If only the tab is closed, the session doesnot expire immediatly. Please help.
Thanks
Shweta
Shweta MishraPosted Feb 18, 2014, 2:33 AM
Shweta MishraPosted Feb 13, 2014, 1:10 AM
As you said, javascript's window.onbeforeunload() event. it is fired on close of browser window
so this works only on browser close, what can we do for tab close?
Shweta MishraPosted Feb 13, 2014, 1:08 AM
Following is the content in our sessionstate tag:
We cannot use any other method; as there are almost 10 services using this and it will not be possible to get into any other mode for session management Please help
The session does expire immediatly if browser exit button is used but nor when tab exit button is user
We are using VS 2012
As you said, javascript's window.onbeforeunload() event. it is fired on close of browser window so this works only on browser close, what can we do for tab close?
Hi Jignesh,
Thanks for the articles and this is the problem we are facing by using cooklieless session where session is stored in url Even if an ignorant user shares his url, he is actually sharing his user informationa and his friend logs in as he This is a huge security threat and it is very important for me to find a solution The post from code-project gives a solution and I will try to work on this to get this fix done
Thanks
Shweta
Jignesh TrivediPosted Feb 13, 2014, 12:24 AM
In ASP.net, session state involves providing a cookie and The cookie contains a session identifier which is used by the website to match visitors up with their respective session values.
If we don't want to carry sessionid in url we have option to use cookie less session
Please refer
http://www.codeproject.com/Tips/627029/Cookieless-Session-in-ASP-NET
http://msdn.microsoft.com/en-us/library/aa479314.aspx
for your second problem, this is because of your cookie does not expire immediately.
hope this will help you.
Ajay PatelPosted Feb 12, 2014, 9:22 AM
2. Session does not expire immediately. It is expire on time out. So if you want sesssion to expire, then do it manually. You can call server side function in javascript's window.onbeforeunload() event. it is fired on close of browser window