Session state problems (.NET 2.0)

[UnlnvlslblE]

Hey guys. I've been trying to figure this whole thing out for weeks now and still have had no luck. I'm not brand new to programming but I'm not a seasoned vet either. I'm working on a team developing a webapp with ASP.NET 2.0 with C#. I have this running on an IIS box which is also running MS SQL server 2005. I have the application's web.config setup to use a custom SQL server database to store the session information.

When a client logs onto the application, a session is started and the browser is given a cookie. The SQL session table is updated with this info as well. I have verified the cookie is created and the table is updated. The problem arises when a user clicks the home button in our application which in turn redirects them either to a welcome page or an admin page based on a session containing an access level. On the initial login the user gets redirected just fine however after being logged in for a minute, if they hit the home button it will throw an exception that the session is null.

Does anyone have any idea of what's going on or how to get this running? I'm not really sure what to do now; I'm really stuck here. Here are a couple code snippets to give you an idea of how things are setup.

From the web.config:

<sessionState
mode="SQLServer"
cookieless="false"
sqlConnectionString="connectionString"
allowCustomSqlDatabase="true"
>
</sessionState>

From the login web form:

protected void LogonUser(object sender, EventArgs e)
{
//Read in the username
String userName = username.Text;
//If the user is authenticated
if (authenticateUser(userName, hashPassword(password.Text), schoolid.Text))
{
//Set a session with their accesslevel
Session["accesslevel"] = getAccessLevel(userName);
FormsAuthentication.RedirectFromLoginPage(userName, false);
}
//If the user was not authenticated
else
{
//Let the user know something went wrong
username.Text = "Invalid username";
schoolid.Text = "Invalid school id";
}
}

From the welcome page (throws a null exception after the user is logged in and clicks home):

if (Session["accesslevel"].ToString().Equals("0"))
Response.Redirect("admin.aspx");

Thanks for reading and thanks for any insight. I'm really stuck here. Thanks!

 

[Cardboard Hammer]

http://weblogs.asp.net/bleroy/archive/2004/08/03/207486.aspx

 

[UnlnvlslblE]

Ahhh. Interesting. Thanks for the tip, I'm testing it this afternoon, hopefully it works!

 

[Cardboard Hammer]

You're welcome.

(Just for clarification purposes, I only found the link (search terms: session redirect) and am not the author.)

 

[UnlnvlslblE]

Well it seems this is not the root of the problem. I keep finding things like this that seem like they are going to fix the situation but don't. Everything looks like its working right but when the user clicks the home button it always comes with a null exception. Anyone have any other ideas? Thanks!

 

[UnlnvlslblE]

I also just noticed something a bit weird. I'm not sure if this is normal, but I checked the contents of the cookie and it had the value for the unique session identifier which was listed as

0yzsnh45ltxpl245yy3e4s45

In my ASPStateTempSessions table it had the value of

0yzsnh45ltxpl245yy3e4s450ae74c0b

It looks like the database value just has 0ae74c0b appended at the end. Is this normal or should they be both exactly the same?

I'm not sure if this is the root of the problem, but it sure is interesting. Any ideas? Thanks!

 

[UnlnvlslblE]

Just for fun I set the application to be cookieless so I could see the GUID in the URL. It looks like every time we click a link on the page it generates a brand new GUID. I'm looking into this further right now. Hopefully I can find a workaround, it is quite weird.

 

[Cardboard Hammer]

Oops... I should've paid a bit closer attention to your code and the posing I found. After taking a closer look, your code already uses FormsAuthentication.RedirectFromLoginPage where the posting indicates it ought to.

Are you sure which page it's blowing up on? If the button click is a postback, it looks like it takes 2 redirects to hit the admin page.

Perhaps the null value is from: Session["accesslevel"] = getAccessLevel(userName);
Can getAccessLevel return null?

EDIT3: hacked out the previous edits

 

[Cardboard Hammer]

Just for fun I set the application to be cookieless so I could see the GUID in the URL. It looks like every time we click a link on the page it generates a brand new GUID. I'm looking into this further right now. Hopefully I can find a workaround, it is quite weird.

The reason for what you see there is that the GUID isn't included in the links, so when you click one, it starts a new session. (I recall running into the same thing loooong ago when I tried sessions without cookies.)

EDIT: It supposedly works for relative links: "ASP.NET modifies the links contained in all requested pages that use a path relative to the application (explicit paths are not modified) by embedding a session ID value in the links just before sending each page to the browser. "

 

[UnlnvlslblE]

The reason for what you see there is that the GUID isn't included in the links, so when you click one, it starts a new session. (I recall running into the same thing loooong ago when I tried sessions without cookies.)

That sounds like it makes sense. However, in my database table a new sessionID is generated everytime I click to another page within the application. If I click 3 things, there are 3 new sessionIDs in the table. So it is generating a new session everytime I navigate to another apge for some reason. Should I be using something else for the menu with the links? Here's a snip from my master page with the menu in it.

<ul id="nav" class="IR">
<li class="home">
<a href="/orc/welcome.aspx"><span class="button"><span class="text">HOME</span></span></a>
<ul>
<li><a href="/orc/info/whatiswia.aspx">What is the WIA?</a></li>
<li><a href="/orc/info/supportingteachers.aspx">How does the WIA support teachers?</a></li>
</ul>
</li>
<li class="nothome">
<a href="/orc/lessonplans.aspx"><span class="button"><span class="text">LESSON PLANS</span></span></a>
</li>


etc...

The weird thing is it only generates new sessionIDs when in the cookieless mode. If it is in the cookie mode only one ID is generated however again clicking on the home button will cause the null exception.

 

[UnlnvlslblE]

I found another thing to try out:

Q: Does presence (or absence) of global.asax affect the session ID?

A: Yes. Suppose you create a brand new web project without global.asax. After all, it’s perfectly normal to leave this file out if you don’t need it. Without global.asax your session cookie will be killed at the end of each page request, and a new one created on every subsequent request. This is to say the session ID will change with every page hit.

Now, suppose you add a blank global.asax. Does this help? No. The session ID will still change until you add an empty Session_Start() handler. If you dig long and hard with Reflector, you’ll see why the mere presence of this particular event handler guarantees that the session cookie will remain intact once it’s issued on first page hit.

I set the accesslevel session in the global.asax to a weird value and it seems to work that way. However the application is still starting up every time I click a link in the page. A new sessionID is generated every time. One step closer, but still not working.

 

[Cardboard Hammer]

I found another thing to try out:

Q: Does presence (or absence) of global.asax affect the session ID?

A: Yes. Suppose you create a brand new web project without global.asax. After all, it’s perfectly normal to leave this file out if you don’t need it. Without global.asax your session cookie will be killed at the end of each page request, and a new one created on every subsequent request. This is to say the session ID will change with every page hit.

Now, suppose you add a blank global.asax. Does this help? No. The session ID will still change until you add an empty Session_Start() handler. If you dig long and hard with Reflector, you’ll see why the mere presence of this particular event handler guarantees that the session cookie will remain intact once it’s issued on first page hit.

I set the accesslevel session in the global.asax to a weird value and it seems to work that way. However the application is still starting up every time I click a link in the page. A new sessionID is generated every time. One step closer, but still not working.

With or without cookies? Or both ways?

 

[UnlnvlslblE]

With cookies enabled it generates only one sessionID when you login and click to a few pages in the application. This seems like it is working. However when you click to a page that checks for the accesslevel session that I set when you login, it throws the null exception.

Without cookies it generates a new sessionID every time you click to a new page. The accesslevel session is not accessable this way either.

These two behaviors seem very conflicting to me. Why would it not generate a new sessionID every time you clicked a page in cookie mode when it does this in cookieless mode? Why does it not retain the state in cookie mode when only one sessionID is generated? Very confusing indeed.

 

[Cardboard Hammer]

Can getAccessLevel return null?

Are you sure it's blowing up where you think it is and that it's not actually on another page where it's being accessed as Session["acceslevel"] (or some other minor typo) that's blowing it up?

What is the exact information provided by the exception?

 

[UnlnvlslblE]

Can getAccessLevel return null?

Are you sure it's blowing up where you think it is and that it's not actually on another page where it's being accessed as Session["acceslevel"] (or some other minor typo) that's blowing it up?

What is the exact information provided by the exception?

The getAccessLevel function could theoretically return null but the way I call the function after doing certain checks would never return null. Its not a typo either.

Well I got home and tested the login and clicking about and it seems to be working right now. I have the app in cookie mode. If however I turn it into cookieless, it generates a new sessionID every time you click to another page. I guess I'll just have to not support cookieless browsers with this app. I really wish I knew what was going on but it seems to be working now.

Thanks for all the help. I think the exception was caused by a combination of not having a session value set in the global.asax file as well as redirecting and closing the response at the same time. Now if I could just figure out what is causing the cookieless to generate new sessionIDs every click.