Session problem

[sillylady]

I am facing problem with the session variables.

I have a login page in my website. Which sets a session variale (Session("username")=form.username) at the time of login.

In signout page I have this code. Session("username")="".

In my other page first I check whether a user is logged in or not by checking variable Session variable. Code is:

If Session("username")="" then
Response.Redirect("login.asp")
End If

If user is already logged in s/he will be directed to his selected page.

My problem is even if the user has signout and if he tries to access protected first time just after signout he sees the page and previous used username is shown as logged in. But if the page is refreshed once, he is directed to login page, means even after signout the session variable still holds last logged in username name, but once the page is refreshed it clears the session variable and direct the user to login page.


Can any one tell me where is the problem?


Thanks

[Danial]

Originally posted by sillylady
I am facing problem with the session variables.

I have a login page in my website. Which sets a session variale (Session("username")=form.username) at the time of login.

In signout page I have this code. Session("username")="".

In my other page first I check whether a user is logged in or not by checking variable Session variable. Code is:

If Session("username")="" then
Response.Redirect("login.asp")
End If

If user is already logged in s/he will be directed to his selected page.

My problem is even if the user has signout and if he tries to access protected first time just after signout he sees the page and previous used username is shown as logged in. But if the page is refreshed once, he is directed to login page, means even after signout the session variable still holds last logged in username name, but once the page is refreshed it clears the session variable and direct the user to login page.


Can any one tell me where is the problem?


Thanks

Thats because your browser is loading the Cached copy. Put the following lines in the pages you want to protect. It will instruct the browser no to cache the page.

I put the code in an Include file ...

Response.CacheControl="no-cache"
Response.AddHeader "Pragma","no-cache"
Response.Expires=0

[sillylady]

Thanks Danial it's working.



Thanks

[mendhak]

Shouldn't you be Session.Abandon()ing instead?

[Danial]

Originally posted by mendhak
Shouldn't you be Session.Abandon()ing instead?

Session.Abandon clears the session, but if you dont instruct the browser not to cache the page, first time the cached page will be loaded even if the user is not authenticated (e.g Session dont exist).

I use :
Session("Username")=""
Session.Abandon

Edit : Just realised you are refering to his/her Session("Username")=""

Yes its better to use Session.Abandon, though some time it fails to work, so to be in the safe side its better to clear it manually first and then using Session.Abandon

[mendhak]

Ah well, those days are behind me now, hopefully. You should consider moving to ASP.NET, Danial. Worth the learning, see?

[Danial]

Originally posted by mendhak
Ah well, those days are behind me now, hopefully. You should consider moving to ASP.NET, Danial. Worth the learning, see?

I have, I dropped ASP a long time ago. Ever since I touched C# i have never looked back . I bet you using VB.net in your ASP.net .

I like answering ASP questions here, havent become a Expert in ASP.net just yet

[mendhak]

Originally posted by Danial


I like answering ASP questions here, havent become a Expert in ASP.net just yet

Same here.

A bit of advice: Take a look at the questions being posted there, try it out yourself, and if you get a solution, post it. If someone else has a better solution, they do eventually post it, so you can take a look at that as well. Posting in the VB.NET forum has helped me gain a lot more in terms of practicality than books.

[Danial]

Originally posted by mendhak
Same here.

A bit of advice: Take a look at the questions being posted there, try it out yourself, and if you get a solution, post it. If someone else has a better solution, they do eventually post it, so you can take a look at that as well. Posting in the VB.NET forum has helped me gain a lot more in terms of practicality than books.

Yep thanks,

I have started posing/replying in C# & ASP.net forum. I despise vb.net (no disrespect), i just fallen in love with c# .


Sorry SillyLady for the off-topic post, hope we could persuade you to upagrade to asp.net too, its so much better you cant even start to compare...

[mendhak]

Yes, we need a silly little lady in the VB.NET forums.