Tech blogg

Session timeout, how to avoid timeouts as long as user is on site

How many times have you pushed the "Save" button just to realize that your session had timed out and you lost everything. Pretty annoying, isn't it?

Well, in my CMS system - Lumino Publish - I had to come up with a good solution for this, and I set out searching the web for a solution. There are actually a lot of solutions out there, and I finally settled for a solution that uses jQuery and its POST routine.

There are several issues you should be aware of when implementing this solution. First of all, session timeouts exist to prevent excessive memory being held up on the server. You may say that I can just increase the SessionTimeout parameter in web.config to let˙s say 2 hours, and problem solved! However, imagine a timeout value of 2 hours on a high traffic site, holding all session data for thousands of user sessions. There is also another problem - and usually related to the previous issue. In the case of shared hosting, you may not even have access to the session timeout, simply because the memory usage has to be controlled. On such systems, web applications often tend to timeout after only 15 minutes, regardless of your settings in the web.config file.

Well, here is a solution that will solve these issues, and avoid session timeouts. Use this solution with caution, as there could be security risks involved in not having web applications time out. The proposed solution relies on javascript, jQuery and a server program (a HttpHandler - SessionRefresh.ashx). The javascript I use is the setInterval function which will run a javascript function at set intervals. This means that we can call the jQuery $.post method at predefined intervals, which will then post to the server, and as a result keep the session alive.

Here is the HttpHandler - SessionRefresh.ashx


<%@ WebHandler Language="C#" Class="SessionRefresh" %>



using System;


using System.Web;

using System.Web.SessionState;



public class SessionRefresh : IHttpHandler, IRequiresSessionState

{

    public void ProcessRequest(HttpContext context)

    {

        context.Session["SessionRefresh"] = DateTime.Now;

    }



    public bool IsReusable

    {

        get

        {            return false;        }

    }

}

All this routine is doing is to update a session object with the current date and time, and thus effectively keeping the session alive. How do we call this program then. Well this is where the javascript and jQuery comes into the picture. Here is the code you should have on your client.


<script type="text/javascript">


$(function () {
    setInterval(SessionRefresh, 540000);  //((10min * 60sec/min) - 60sec) * 1000msec/sec = 540.000msec    Set 10min SessionTimeout in web.config.
});
function SessionRefresh() {
    $.post("/SessionRefresh.ashx", null, function () {
        $("#testResult").append("<p>Session updated!<p/>");
    });
}


</script>


 Your code goes here....



<div id="testResult"></div>

The last <div...> is of course there for testing purposes. When the program "SessionRefresh.ashx" executes, the text "Session updated!" is written back into the "div" element.

Happy refreshing :)

André Vold

22.02.2010

Kommentar

Skriv kommentar

André Vold

Her er en rask liten BLOGGER BIO for å fortelle litt om min bakgrunn - og hvorfor jeg valgte programmering som fagfelt.

Jeg vokste opp i Norge, men gikk på universitet i USA. Jeg er sivilingeninør med grad innen "Computer Engineering" fra Arizona State University. Etter utdannelsen flyttet jeg tilbake til Norge, begynte å arbeide på Norsk Data og senere IBM, og tok videreutdannelse på BI innen Master of Management. Etter flere år som divisjonsdirektør i IBM Norge, valgte jeg å starte e-læringsfirmaet Apropos Internett AS . Senere startet jeg også ViroSafe Norge AS som importerer og distribuerer anti-malware og anti-virus software og hardware.

Det har alltid vært essensielt for meg å holde meg oppdatert innen teknologiske endringer og trender - ikke bare for å kunne holde programmeringskunnskaper på topp, men også for min suksess som gründer.

Lumino blogger omfatter en rekke temaer som har vært essensiell for min virksomhet, og som derfor kan være relevant for din.