2

I have a website hosted on a shared hosting server. Currently I'm using in-proc session state, but I'm facing issues like whenever I change the code (mostly noticed in App_Code), my session breaks and the user is logged out. I have some questions:

  1. Is there anything which can help me prevent losing the session when I change the code?
  2. If that's its normal behaviour, then how about switching to SQL Server session state?
  3. Can I configure it on a shared hosting server? What would be the steps?
  4. Do I have access to the session using a normal Session object or do I need to go the usual database connection way?

I've tried configuring it from my local machine, using the aspnet_regsql command, and I provided the hosting server with the database IP. It finished successfully, but it didn't work when I made changes to the web.config file.

These are my changes to web.config:

<sessionState
   mode="SQLServer"
   sqlConnectionString="data source=[DB IP];user id=username;password=password;initial catalog=[db name on production]"
/>

Am I doing anything wrong here?

2
  • SQL will work fine and normally, and is definitely preferred over in-proc if you're serious about keeping your session intact (especially over shared hosting) - but be aware that it's significantly slower, and you also have to make sure everything you store in session is serializable. Once you've accepted that, you can use whatever SQL Server instance you want, as long as you've set up the database objects properly. If you're having issues hooking up to a working SQL session instance you'll need to provide more details about what's going wrong.
    – Joe Enos
    Jul 25, 2014 at 22:04
  • What you are doing does appear to be correct. Are you able to look at the data in SQL and confirm that your session data is being stored there? Jul 25, 2014 at 22:05

2 Answers 2

0

Check the session state modes http://msdn.microsoft.com/en-us/library/vstudio/ms178586%28v=vs.100%29.aspx

You need to use something else than "in-proc".

In terms of shared hosting - I have experience with only discountasp.net and am using sql server session state with no issues. It requires another database but works well.

I also guess you'll have to use the:

allowCustomSqlDatabase="true"

in your web config as database name for your sessions differs from default name.

Check this http://msdn.microsoft.com/en-us/library/h6bb9cz9%28v=vs.90%29.aspx

-1

I can really only answer your first question:

"1. Is there anything which can help me prevent losing the session when I change the code?"

Annoyingly there is nothing that can be done. Once you "bounce" the website (e.g. modify the web.config) you will cause all sessions to end and everyone gets logged out due to the loss of the log in data being removed.

It sounds like you might be better off changing this up to use FormsAuthentication (this is MVC.NET code but the code is still valid for other asp.net applications) as that is stable across code changes e.g.

using System.Web.Security;

public function ActionResult Login(LoginModel model)
{
    var password = FormsAuthentication.HashPasswordForStoringInConfigFile(model.Password 
    + System.Configuration.ConfigurationManager.AppSettings["salt"].ToString(), "sha1");

    if (new UserService().Login(model.EmailAddress, password))
    {
        FormsAuthentication.RedirectFromLoginPage(model.EmailAddress, true);
    }
}

Using FormsAuthentication will mean that your users will be "remembered" by asp.net land and changing the web.config won't kill their logged in session.

If you use this method, but still want to log a user out when they close their browser, you could at the point of logging in above set a session cookie, a standard session cookie not a session variable that is volatile across code changes. This cookie will be killed off by the browser when the user closes their browser. The cookie could be as simple as a "loggedIn:yes". This cookie along with a check against the FormsAuthentication Identity value e.g.

if(!HasLoginCookie() || !System.Web.HttpContext.Current.User.Identity.IsAuthenticated)
{
   // redirect user to log in page.
}

will then log a user out if the cookie has been remove. FormsAuthentication will also automatically log out after a set amount of time of inactivity which adds an extra layer of security. Hope this helps.

6
  • This is incorrect, sessions should only end if the session data is being stored in-process. The OP stated that they are trying to use out-of-process session storage. Jul 25, 2014 at 22:06
  • I have to disagree with your comment. The opening statement reads: "Currently I'm using in-proc session state" Jul 26, 2014 at 12:50
  • Sorry my laptop died when I was trying to clarify my statement. Session variables are volatile to changes in code, so using log in information stored in Session is dangerous. This can be proven with a simple web page. if (Session["userId"] == null) { Session["userId"] = Guid.NewGuid().ToString(); } litUserID.Text = Session["userId"].ToString(); Run the page, see Guid. Change something in web.config. Re-run page. See the Guid change. 4guysfromrolla.com/webtech/faq/Advanced/faq4.shtml My post I believe is still valid even if down voted twice without a real answer. Jul 26, 2014 at 15:54
  • The opening statement does read that, however he then asks for help getting session data stored in SQL Server. Your answer then starts "Annoyingly there is nothing that can be done" without mentioning you are only referring to his first point (which he already appears aware of). Jul 26, 2014 at 22:57
  • Okay. I will take your point. I was mainly asking about the initial question "Is there anything which can help me prevent losing the session when I change the code?" which I answered, but yes you are right I am not clear that I was only answering this. I shall edit my answer to reflect this. Jul 27, 2014 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.