Session won't abandon?

[JMik]

Hello everybody,

I'm kind of new to ASP, although I've been a VB programmer for a while now, and there's a little thing that's really bothering me, so maybe someone can help me out:

I have this ASP page, which relies on sessions. When someone clicks on a given link, the page calls itself with a URL parameter to trigger the abandon session. That works great, and the message that the session has been abandonned appears. However, if I then return to the previous page and even click refresh, the session is still alive and well and everything appears to be as before. So what gives, am I missing something?

Thanks in advance,

JMik

[JoshT]

By re-requesting the page from the web server, you are beginning a new session.

Josh

[compuGEEK]

Hi,

In addition to session.abandon, I would set the session variable = " "

Good luck!

CG

[sebs]

Try:


session.expires=0


it will never be store in the cache of your browser

is that what you need!!

[JMik]

Hey Guys,

I want to thank everybody for their help, but unfortunately, none of this seems to work:

JoshT:
The whole problem is, it's not starting a new session. The session ID remains the same, despite the fact that the session.abandon was triggered during the last operation.

compuGeek:
I'm not sure how I would go about doing this, since Session = "", Set Session = Nothing and Session.Value = "" all seemed to be invalid operations. What did you mean exactly?

sebs:
"Expires" doesn't seem to be a valid method of the Session object. Could you explain that a little more?

Thanks again guys,

JMik

[compuGEEK]

You can try:

session("NameofSessionVar") = " " 

-or-

session("NameofSessionVar") = NULL

-or-

session.contents.remove 'NameofSessionVar' (sans the quotes)

[sebs]

sorry, i meant
response.expires = 0

sorry, it will work!

[JMik]

Hello again everybody,

Sebs, expiring the page didn't seem to have any effect either, which is getting very puzzling.

CompuGEEK, I'm not using session name variables in the way you describe, which leads me to believe that maybe I don't understand this whole session thing at all. This is the way I currently have it set up when a user visits the page:

1) The page checks the current Session ID value and compares it to the value stored within the user's cookie.

2) If there is a match, brings the user to the main page.

3) If not, presents the login page. Once the user logins successfully, the current session's ID is stored in the user's cookie and then goes back to 1.

So, given this system, I don't see why I would need to use session name variables... Unless I'm missing something?

Thanks to everyone for their help,

JMik

[compuGEEK]

JMik,

But how are you initializing your session ID variable? Could you post your code?

Cool

CG

[JMik]

Sure, here it is... I trimmed it a bit (it was quite long), but the principals are intact.

	Function ValidLogin
	
		Dim strEmail
		Dim strPass
		
		strEmail = Request.Form.Item("Addr")
		strPass = Request.Form.Item("Pwrd")
		
		If Trim(strEmail) = "" Or Trim(strPass) = "" Then
			ValidLogin = False
		Else
		
			OpenDB
		
			If ValidEmail(strEmail) And CorrectPassword(strEmail, strPass) Then
				ValidLogin = True
			Else
				ValidLogin = False
			End If
			
			CloseDB
			
		End If
	
	End Function

	'----------------------------------------------

	Function ValidCookie
	
		If Trim(strUserID) = "" Or Trim(strSessionID) = "" Then
			ValidCookie = False
		Else
		
			OpenDB
			
			' ValidEmail is a simple function that checks to see if the user id exists in the database. Returns true if it does.
			If strSessionID = Session.SessionID And _
			   ValidEmail(strUserID) = True Then
				ValidCookie = True
			Else
				ValidCookie = False
			End if
			
			CloseDB
			
		End if
	
	End Function

	'----------------------------------------------

	strUserID = Request.Cookies("ThisPage")("UID")
	strSessionID = Request.Cookies("ThisPage")("SID")

	'----------------------------------------------

	If ValidCookie Then

	'> Valid Cookie

		' Check for url parameters
		If Request.Form.Count = 0 And Request.QueryString = "" Then

			' No Parameteres, display main page
			DisplayMainPage()

		Else
		'> Parameters were specified
		
			If Request.QueryString <> "" Then
			
				If Instr(1, Request.QueryString, "=") = 0 Then
			
					Select Case LCase(Request.QueryString)
						Case "goodbye"
							Response.Write("Goodbye!")
							Session.Abandon
						Case Else
							Response.Write("Sorry, this is not a valid request.")
					End Select
					
				End If	
				
			End If
		
		End If
	Else

	'> Invalid Cookie
	
		If Request.Form.Count = 0 And Request.QueryString = "" Then

			DisplayLoginPage()

		Else
		
			If ValidLogin Then

				'Set cookie with this session's id and user id
			
				Response.Cookies("ThisPage") = ""
				Response.Cookies("ThisPage")("UID") = Request.Form.Item("Addr")
				Response.Cookies("ThisPage")("SID") = Session.SessionID

				'Reload this page
				
				Response.Redirect("ThisPage.asp")
					
			Else
				'Bad name or password

				Response.Write("Invalid Login. Your e-mail address or password may be incorrect. Please try again.")
					
			End If
			
		End If
		
	End If

JMik

[compuGEEK]

With Session.Abandon, it's important to remember that your session variables aren't actually destroyed until the every script on the page has been processed. So, you could put Session.Abandon as the very last statement of your code.

Another way is to use a For loop using Session.Contents

<%
  For Each x in Session.Contents
      Session.Contents.Remove(x)  
    End If
  Next
%>

Anyway, I hope you're able to find a solution.

CG