Web Development

16-Oct-07 5:53

Great glad you got it working.

Ben

Session variable expires

hifiger200415-Oct-07 23:24

15-Oct-07 23:24

Hi,

I have a problem handling session variable.
How can I control the session variable from expiring? Is there any properties to be added in each page or to be added in web.config?

Thanks

hifiger2004

Elizma16-Oct-07 2:08

Elizma

16-Oct-07 2:08

Hi,

You have to create them (declare) in the Global.asax file in the Session_start() event.

E.g.

Session["Name"] = "";

Regards,

Elizma

hifiger200416-Oct-07 5:06

16-Oct-07 5:06

Hi,

I encounted this problem when the the browser or the computer is idle.

Error message below:

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machinekey>
configuration specifies the same validationkey and validation algorith. AutoGenerate cannot be used in a cluster.

hifiger2004

hifiger200416-Oct-07 5:23

16-Oct-07 5:23

Or is there a way to handle the error so I can change the error message?

hifiger2004

kubben16-Oct-07 2:37

16-Oct-07 2:37

In the web config file there is a section that you can put the timeout in:
<sessionState mode="InProc" timeout="30"></sessionState>

In the example above it is 30 minutes.

Now there are some other things to consider. Your application pool that your web site runs under by default recycles every 27 hours. Everytime that happens you will lose your session. First is is always a good idea to change your application pool recycle time to some time, perhaps early in the morning 2am, 3am when users are not using your site. Again if you application pool is getting recycled it will end your session. All of this is assuming that you are using InProc as your Session Mode. That means the Session info is stored on the web server. There are other options which would allow you session to last longer. One option stores session on a different server and the other option stores it in sql server. These each have ther advantages and disadvantages.

I would think long and hard before you decide to increase your session timeout to a large number. I really don't think you want to keep your session around for longer then an hour or so. If someone has not actively used your site in an hour you should timeout their session. They are using up resources that others could be using.

Hope that helps.
Ben

hifiger200416-Oct-07 5:06

16-Oct-07 5:06

hifiger2004

kubben16-Oct-07 5:35

16-Oct-07 5:35

Ok, it sounds like your web application might be hosted on a web farm. If this is true you must select a different mode for session state other then InProc which is the default. If you are using InProc and you have a web farm or cluster what can happen is a user starts there session on one web server and the session info is there, then on their next request the go to a different web server which doesn't have the session state info. That would be why you are getting your error. You need to look at having a sessions state server or store session in sql server.

Ben

hifiger200417-Oct-07 1:16

17-Oct-07 1:16

Yes, you are right Smile | :)

But how can I catch the error so I can inform the user that the browser needs to be refresh. I will inform the user thru the msgbox.

hifiger2004

kubben17-Oct-07 1:33

17-Oct-07 1:33

That is the wrong thing to do. Asking the user to refresh doesn't mean their next request will go to the correct web server that has their session info. They might just get the same error over and over. I think you should really look at setting up a session server so that your session state will work on your web farm / cluster.

Ben

hifiger200417-Oct-07 2:30

17-Oct-07 2:30

Honestly I haven't tried yet if how it will be done using the session server and on how to setup he session server.

I think it will take me long enough before the session server will be created, isn't it?

But for now, I think I will have to catch the error first, but the problem is I don't have an idea on how to catch it.

Maybe that's the next thing that I must do, the session server. And maybe I will search for some steps on how to do it, later. Smile | :)

hifiger2004

kubben17-Oct-07 2:45

17-Oct-07 2:45

I have never set up a state server for the session state, but I don't think it is that hard. Still it is the right thing to do. Here is the Microsoft help on State server. It gives you all the details you need to set it up.

StateServer mode stores session state in a process, referred to as the ASP.NET state service, that is separate from the ASP.NET worker process or IIS application pool. Using this mode ensures that session state is preserved if the Web application is restarted and also makes session state available to multiple Web servers in a Web farm.

To use StateServer mode, you must first be sure the ASP.NET state service is running on the server used for the session store. The ASP.NET state service is installed as a service when ASP.NET and the .NET Framework are installed. The ASP.Net state service is installed at the following location:

systemroot\Microsoft.NET\Framework\versionNumber\aspnet_state.exe

To configure an ASP.NET application to use StateServer mode, in the application's Web.config file do the following:

Set the mode attribute of the sessionState element to StateServer.

Set the stateConnectionString attribute to tcpip=serverName:42424.

Note
To improve the security of your application when using StateServer mode, it is recommended that you protect your stateConnectionString value by encrypting the sessionState section of your configuration file. For details, see Encrypting Configuration Information Using Protected Configuration.

The following example shows a configuration setting for StateServer mode where session state is stored on a remote computer named SampleStateServer:

Copy Code
<configuration>
<system.web>
<sessionstate mode="StateServer"
="" stateconnectionstring="tcpip=SampleStateServer:42424" cookieless="false" timeout="20">

Note
Objects stored in session state must be serializable if the mode is set to StateServer. For information on serializable objects, see the SerializableAttribute class.

To use StateServer mode in a Web farm, you must have the same encryption keys specified in the machineKey element of your Web configuration for all applications that are part of the Web farm. For information on how to create machine keys, see article 313091, "How to create keys by using Visual Basic .NET for use in Forms authentication," in the Microsoft Knowledge Base at http://support.microsoft.com.

Hope that helps.

Ben

hifiger200417-Oct-07 3:14

17-Oct-07 3:14

Ok I will try it Smile | :)

And one more thing, aside from modifying something into the web.config, do I need to modify something also in my session variables to all the aspx pages that has a session variables? Or I will just leave it as is?

Thank you Ben

hifiger2004

kubben17-Oct-07 3:17

17-Oct-07 3:17

You just need to make sure that all the config files on the web farm have the same value. As long as the session state service is running everything should just work. So you don't need to change the way you are using the session variable and your errors should go away.

Ben

hifiger200419-Oct-07 7:02

19-Oct-07 7:02

Thanks Ben Smile | :)

hifiger2004

hifiger200416-Oct-07 5:23