Make session last forever

Introduction

You are not always have a luxury to bump up the Session expiration period from 20 minutes on a server (most likely you are on shared hosting). Plus it's a bad idea to unnecessary consume the resources on a server. I have a simple solution that will take care of that problem.

Solution

The solution is simple. Lets create an aspx page that will return 1x1 transparent gif image and with javascript refresh it every 15 minutes. Thus the browser will renew the session every 15 minutes if user simply reading long text on a page or walked away to get a cup of coffee. But as soon as browser closed (or user navigated away from our site) the Session will expire right after 20 minutes of inactivity. And we do not consume the resources on a server.

Implementation

The implementation is rather simple especially in .NET environment.

1. Create renewSes.aspx page

2. In code behind have following lines

public class renewSes : System.Web.UI.Page
    {
        static byte [] gif = {0x47,0x49,0x46,0x38,0x39,0x61,0x01,0x00,0x01,0x00,0x91,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x21,0xf9,0x04,0x09,0x00,
0x00,0x00,0x00,0x2c,0x00,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x00,0x08,0x04,
0x00,0x01,0x04,0x04,0x00,0x3b,0x00};

        override protected void OnInit(EventArgs e)
        {
            InitializeComponent();
            base.OnInit(e);
        }
        
        private void InitializeComponent()
        {    
            Response.AddHeader("ContentType", "image/gif");
            Response.Cache.SetCacheability(HttpCacheability.NoCache);
            Response.BinaryWrite(gif);
            Response.End();
        }
}

This code will simply output small 1x1 transparent gif which is in the array "gif" so we do not need to hit the file system for that. Plus the Cacheability is set to NoCache, we do not want browser to hit cache, we want it to renew our session.

3. Create user control that has following HTML

<script language="Javascript">
window.setInterval("renewSession();", 600000);
function renewSession()
{document.images("renewSession").src = "/renewSes.aspx?par=" + Math.random();}
</script>
<img src="/renewSes.aspx" name=renewSession id=renewSession>

The code simply hits /renewSes.aspx every 10 minutes. Thus keeping your session alive. Plus the Math.random was added to avoid caching in the browser.

4. Dump it on every page somewhere. Or if you are using templates then simply add it to your master page.

5. Done!!!!!!. You might want to move the JavaScript code to RegisterClientScriptBlock but it's not necessary

Conclusion

Obviously this method will only work if JavaScript is on but it's a majority, plus do not forget it's only for rare cases when user leaves your page open and walks away expecting you will keep him logged in forever. The Server resources are minimal since the sessions will continue to expire every 20 minutes when user navigated away and the only excessive traffic is those 48 bytes every ten minutes to keep the session alive.

Sample

If you want to see how it works feel free to visit my E-Commerce Body jewelry site. Add something to the shopping cart and wait for 20 minutes or for couple days. When you will be back the cart still going to be there.

You must Sign In to use this message board.

FAQ    Noise Tolerance Very HighHighMediumLowVery Low   Layout Expand Posts & RepliesThread ViewNo JavascriptNo JS + Preview   Per page 102550

Msgs 1 to 25 of 59 (Total in Forum: 59) (Refresh) FirstPrevNext

Rainbow jewels imaginaryplaymate 23:38 20 Dec '08   Hey, I've looked at your "mspiercing" Body jewelry website. Couldn't find there gay jewels, I've looked online and found Rainbow Jewelry at "Love And Pride". I like your pink "eyebrow rings" but they ain't gay enough Sign In·View Thread·PermaLink 1.00/5 (1 vote) the same with asp? ran9 1:26 20 Nov '07   how can I do the same with classic asp? thanks. Sign In·View Thread·PermaLink Dreamers! beep 6:40 1 Nov '07   These comments crack me up. Most of us would be happy to have 200 concurrent users on our website. Let's say that each one used up 100KB of session memory (a generous amount). That's still only 20MB of memory! Visual Studio regularly exceeds 200MB on my machine. Also, remember that many session variables are references to existing objects in Application or Cache scope, so those are simple pointers, taking up just a few bytes. There is a reason that MS used to discourage the use of Session in classic ASP, and why now they encourage it. It works! For most websites, we should be more concerned about performance than we are about scalability, simply because most websites that we create won't need to scale all that much. And if they do, that's a great problem to have! We can solve it when we need to. I'm so concerned about performance that I've even started storing ViewState in Session. Just put the following into the page that has a heavy ViewState load: /// /// Override to persist view state in Session. /// protected override PageStatePersister PageStatePersister { get { return new SessionPageStatePersister(this); } } This little piece of code has really made my AJAX pages pop. Now why would MS give us this choice if they didn't think Session was a great thing? I like this solution. It lets me keep my "configurator window" open and the user can browse the rest of the website and add products. When the configurator window is closed, voila! the session goes away after a period of time. --Bruce Sign In·View Thread·PermaLink 1.00/5 (1 vote) Why using a random number? Adam Tibi 0:13 1 Dec '06   Hi, I was following the trend and using a random number in the JavaScript callback, then I thought that why not using a DATE rather than a random number? There is no probability that the DATE maybe repeated (unless some one invents the time machine and then you can update the article if we are still alive or if any one know what is .NET). Regards, Adam Tibi Make it simple, as simple as possible, but not simpler. Sign In·View Thread·PermaLink not fully argee Effun Din 22:36 30 Oct '06   i think a permanent session may cause some security issues. the better way is to set a larger number of timeout for session for preventing user from frequently login. Sign In·View Thread·PermaLink Re: not fully argee Adam Tibi 4:49 31 Oct '06   Dear Effun, I might agree with you if the logged user had his credentials submitted, while in other cases, you need to keep the sessions for anonymous users and in this case there is no security issue. Regards, Adam Tibi Make it simple, as simple as possible, but not simpler. Sign In·View Thread·PermaLink Re: not fully argee Effun Din 5:17 31 Oct '06   Hi Adam, Yes, you are right. But I think, a good asp.net developer should not make their program depend on session states. Sometimes we need to store data in session, but we must prepare for losing session, and write code for representing data in session, just like in Cache. What I do in my code, is just store some most recently accessed objects in session for improving performance. So I need not worry about when the session will be lost. Sign In·View Thread·PermaLink Another improvement DejaVudew 4:07 10 Oct '06   Before keeping a user's session from being maintained "forever", you might add a few checks to make sure they're still on the page. In other words, watch mouse and key events before deciding to keep the session alive. It generally is a good idea to let "user-abandonded" sessions expire so that the server can reclaim the resources more quickly, but, of course, you don't want to allow a users session to expire if they're doing something client-side (like typing). Obviously, it just depends on your needs. Sign In·View Thread·PermaLink Re: Another improvement Gevorg 9:41 10 Oct '06   Obviously you have not read an article or completely misunderstood it. Suggested way allows to keep session alive only for those users who have your site open in their browsers. As soon as user navigated away session will expire as it normally would. Simply because browser is keeping session alive by pinging server every 10 minutes or so. And no need to check mouse or key events. My site - Body Jewelry Not my site - Piercing info Sign In·View Thread·PermaLink Re: Another improvement DejaVudew 13:01 10 Oct '06   ...or you didn't understand my comment. My suggestion was that you could time-out sessions that had left their browser window open and were not doing anything. This is what I meant when I said "user-abandoned". If someone leaves their browser window open on your website, it would be better for performance if: a.) you aren't pinging users that aren't doing anything, and, b.) you aren't keeping sessions alive for users that aren't doing anything. My suggestion was not that you could run javascript on a closed window or that your article did not do what you said it did. Believe me when I say that I read and understand your article. I even read the bit where you say that most users don't just leave their browser windows open. I've implemented similar approaches (both with HTTP handlers and much earlier using refresh). Sign In·View Thread·PermaLink Re: Another improvement Gevorg 9:14 12 Oct '06   Well, I thought the whole point is to keep session alive for those people who kept their browsers open on your website. they simply went to coffee shop and met pretty girl he spent a night with.... I do not want him to loose his shopping cart just because of that. Amount of such users are miniscule. Most of them do turn off their PCs when they done. So there is no stress for the server. My site - Body Jewelry Not my site - Piercing info Sign In·View Thread·PermaLink Another aproche Zorbek 14:22 9 Oct '06   What if you used AJAX or maybe an IFRAME (anoying clicks) to send a much smaller request to a separate aspx file that will not return more than a small valid xml like <ANSWER/>? //On the client, call this funtion from your BODY.onLoad event function notify() {       //Call the page using your AJAX implementation       YourAjaxImplementation("keep_alive.aspx");             //Use the session's time value minus 1 minute to recall       window.setTimeout(notify,<%=m_iSessionTimeOut%> - 60000);      } On the server, make sure to declare the m_iSessionTimeOut variable and set it to Session.TimeOut or anything you like. /Xavier Sign In·View Thread·PermaLink Profile? [asp.net 2.0] BigBenDk 12:48 21 Aug '06   Why not use the ProfileProvider system? It uses the membership provider for authentication, and expires when then the cookie expires. Only requirement is that it is serializable. And it is typesafe - session issent any good for storeing information. Session(var) are offent misused, possible just because we used to do things this way. Beauty is in the eye of the beerholder :P Sign In·View Thread·PermaLink Re: Profile? [asp.net 2.0] Gevorg 3:34 22 Aug '06   ProfileProvider framework is good only to keep user's settings. It was not designed to be a replacement for Session object. Session is used to keep application's workflow data. My site - Body Jewelry Not my site - Piercing info Sign In·View Thread·PermaLink Re: Profile? [asp.net 2.0] Mivano 5:06 7 Oct '06   Combine it with the AnonymousModule (standard part of ASP.NET 2.0) and it is possible to store user settings for anonymous users. A GUID is created when a visitors visits the site, and this is stored inside a cookie. Together with the membership module, the data is stored inside the database. Next time the visitor requests a page, the cookie is retrieved and the data (profile data) is retrieved from the profile tables. Yes, profile and session are different things, but it is nice to now it is possible to store anonymous userdata. Sign In·View Thread·PermaLink Slight modification Symo S 7:11 21 Aug '06   Great little solution without requiring an IFRAME, however it has a major drawback if the page uses absolute positioned controls - the gif takes up space on the page and everything is shifted downwards. It can be overcome by modifying the <img> tag in the host page - <img src="/renewSes.aspx" style="display:none" name=renewSession id=renewSession> slightly more overhead but the image will be hidden and still cause the 'ping' Sign In·View Thread·PermaLink Re: Slight modification Trevahaha 16:25 28 Nov '07   Watch out with the "display:none" -- some browsers won't make the call to download the image, so it might not execute on the server! Sign In·View Thread·PermaLink Re: Slight modification jonnoshaw 17:06 3 Apr '09   Create a css class in your site's theme: .hidden {position:absolute; left:0px; top:-500px; width:1px; height:1px; overflow:hidden;} then in the code: <span class="hidden">             <img src="./renewSes.aspx" name="renewSession" id="renewSession"/> </span> This will position the image off the page so will not affect layout however will not be ignored by the browser. Cheers Jonno Sign In·View Thread·PermaLink Amazing Work !! bobtxt 23:23 8 Aug '06   Very helpful, Amazing Work !! na na na na na na na na na Sign In·View Thread·PermaLink Its a good idea but here's a slight improvement Robert Ensor 18:21 30 Jul '06   A very similar thing has been done before on this site: http://www.codeproject.com/aspnet/Session_Defibrillator.asp[^] I think their approach is better since: * The timeout isn't hardcoded * They dont rely on the random number to override browser caching. What if you got the same random number twice! I think it's a shame that so many people are saying bad things about your article - it's obvious that they dont really understand the situation (browser being closed vs user walking away for coffee). Maybe they need to re-read your article. I think this is a great idea. Unfortunately it's been a great idea longer than you realised Sign In·View Thread·PermaLink Re: Its a good idea but here's a slight improvement Gevorg 5:38 31 Jul '06   Yea, thanks. Did not see that article. My site - Body Jewelry Not my site - Piercing info Sign In·View Thread·PermaLink Re: Its a good idea but here's a slight improvement Adam Tibi 3:19 1 Aug '06   Robert, Relying on random number is an issue, but you could have fixed that with 1/2 a line of code by creating a number that keeps incrementing one by one. That article relies on IFrame which is no longer an XHTML element, check XHTML 1.0 Strict and XHTML 1.1, so it is going out of the market soon! So this is the big issue! Also, that approach is not cross browser compatible, for instance, it doesn't work on FF, while this one does! So, I disagree on that being a better approach. Cheers, Adam Tibi Make it simple, as simple as possible, but not simpler. Sign In·View Thread·PermaLink Re: Its a good idea but here's a slight improvement Gevorg 12:09 1 Aug '06   Yes, the random number is not an issue, it actually works without it with that line Response.Cache.SetCacheability(HttpCacheability.NoCache); I added that only for goofy browsers and proxy servers. All AOL users using AOL's proxy servers and META REFRESH would fail with them to work as intended. Plus setting limit to 9 minutes you have a chance to hit the sessionrenew page 2 times in 20 minutes interval. Thus pretty much eliminating problem. -------------------------------------------------------- Somehow I do not think that IFRAME is going away anytime soon (most likely never ). The whole Google's AdSence is built on using IFRAME. Plus I am positive that Yahoo and MSN using same approach. So you got serious money there and most likely standard would be changed to have IFRAME. So safe bet that we will have IFRAM for long time. --------------------------------------------------------- But I agree, it's a huge issue that IFRAME approach does not work on FireFox. According to my statistic around 10% using FireFox and it's a lot in Ecommerce world. My site - Body Jewelry Not my site - Piercing info Sign In·View Thread·PermaLink Re: Its a good idea but here's a slight improvement [modified] Robert Ensor 12:53 1 Aug '06   An excellent point Adam. I wasnt aware that this didn't work in firefox, can you tell me exactly what goes wrong? Ok I'm convinced that an image refreshed with javascript is better than an iframe with refresh headers (since IFrames are deprecated (although I think they will be supported for a long long time)). But I would improve this solution by replacing the 60000 milliseconds in the javascript timeout with actual session timeout taken from the web app (minus one minute). And I'd use a generic hhtp handler (.ashx) instead of an aspx page. You'd have to keep the incremented number in a cookie since the browser cache lasts a lot longer than the javascript variables. I would personally use the "milliseconds since the epoch" as a cache-defeating parameter. Cheers - Rob -- modified at 17:54 Tuesday 1st August, 2006 Sign In·View Thread·PermaLink Re: Its a good idea but here's a slight improvement Adam Tibi 22:38 1 Aug '06   It doesn't work with FireFox, I read that in the comments, I didn't test the code myself. I am using http handler and I also pushed this code inside a web control so that I can drag and drop it easily on any web form that needs to have a continuous session. I also made the refresh rate slightly lower than the session timeout. Gevorg gave me the spark Cheers every one Make it simple, as simple as possible, but not simpler. Sign In·View Thread·PermaLink

Last Visit: 1:46 23 Nov '09     Last Update: 1:46 23 Nov '09 123 Next »