Forum  Commercial Foru...  Commercial Foru...  !!! huge problem, users get sessions of other users !!! (IIS7 bug?)
Previous Previous
 
Next Next
New Post 9/23/2009 11:47 AM
  itzik.spitzen
1659 posts
1st Level Poster




Re: !!! huge problem, users get sessions of other users !!! 

Hi,

As Ori mentioned, Visual WebGui cannot cause this phenomenon by infrastructure, as interacting from one IIS session object to another practically means hacking IIS and ASP.NET.

I suspect that you have some false business logic which has the power to switch between the active users somehow, however, there is no chance we will be able to truly validate that you without a working sample. I truly understand that you can't possibly send the app over, but since you think it's a VWG phenomenon, it should be possible to create some kind of small app reproducing this issue.

A couple of applicative hints I can think of:

1. Try to think of your logon mechanism, where exactly in your code the logon process is performed? could this code be invoked in other then logon cases? Do you use VWG form logon? Windows Authentication SSO? or you have built your own mechanism? 

2. Do you have some code within ASP.NET Session_OnEnd procedure?

3. Have you been using timers? in case you did, can the code there cause switching users/logon/logoff?

4. Have you been using threads? Note that IIS threads are limited and are unsafe unless synchronized programmatically.

5. Have you been using COM or other interoperated non .NET components? can this be the reason for threads in safety?

One information piece I find very important, do you know if the other user that the app happened to switch to was logged on to the system at the same time the users were switched?

I hope this helps...

Kind Regards,
Itzik Spitzen

 
New Post 9/23/2009 12:26 PM
  Visualizer
665 posts
1st Level Poster




Re: !!! huge problem, users get sessions of other users !!! 

Hi Itzik, thank you for the comprehensive answer. I'm not sure it's a vwg problem, what i understand from you it cannot be a vwg problem.

I personally think it has something todo with timeouts, because it only happend after a long time the session is incative. Then when you refersh the screen again you suddenly have somebody else his session. But what i dont understand is how i can get another user session on my client. Every time i pressed F5 then the changes the other user does reflect on my client.

I'm not really an expert on this part, maybe you can shine a light on that one. I will discuss it with my lead developper also tomorrow morning and then i will come back with the results.

Regards,

Tom

 
New Post 9/23/2009 6:49 PM
  palli
11189 posts
1st Level Poster




Re: !!! huge problem, users get sessions of other users !!! 
Modified By palli  on 9/23/2009 8:50:09 PM)

Hi Tom,

This might be a long shot, but I found this thread here in Google search from a user experiencing similar problems, which turned out to be caching related. Please take a look and see if this could possibly apply to your case.

Palli

 


Páll Björnsson - Visual WebGui support team - Email: support@visualwebgui.com
 
New Post 9/24/2009 1:01 AM
  Visualizer
665 posts
1st Level Poster




Re: !!! huge problem, users get sessions of other users !!! 

Tnx Pali, we cache some objects to keep the application fast but we don't cache pages at all.

Just some other thoughts....

    <!--  SESSION STATE SETTINGS

          By default ASP.NET uses cookies to identify which requests belong to a particular session.

          If cookies are not available, a session can be tracked by adding a session identifier to the URL.

          To disable cookies, set sessionState cookieless="true".

    -->

    <sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes" cookieless="false" timeout="20" />

 

>>> By default ASP.NET uses cookies to identify which requests belong to a particular session. <<<

This is exactly what goes wrong and it only goes wrong after a time of inactivity, 20 minutes, whats the timeout parameter.

 

Trying to avoid the timeout and keeping the session open we implemented the auto logout feature.

 

System.Web.HttpContext.Current.Session.Timeout = 10;

 

The strange thing is that it's working perfect on the local development environment, it automaticly returns to the login screen after 10 minutes. But if we deploy it on the iis production environment then it doesn't work.

 

Can it be an IIS7 problem or configuration issue?

 
New Post 9/24/2009 3:23 AM
  Visualizer
665 posts
1st Level Poster




Re: !!! huge problem, users get sessions of other users !!! 

We discoverd something else..

Scenario 1 (user returns to login screen after 1 minute)

<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes" cookieless="false" timeout="15" />

System.Web.HttpContext.Current.Session.Timeout = 1;

 

Scenario 2 (user returns to login screen after 15 minutes  !?!)

<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes" cookieless="false" timeout="15" />

System.Web.HttpContext.Current.Session.Timeout = 5;

 
Previous Previous
 
Next Next
  Forum  Commercial Foru...  Commercial Foru...  !!! huge problem, users get sessions of other users !!! (IIS7 bug?)
Azure banner
.NET Web, Cloud and Mobile application delivery platform | Sitemap | Terms of Use | Privacy Statement | Copyright © 2005-2011 Visual WebGui®       Visual WebGui weblog on ASP.NET Visual WebGui Group on LinkedIn Visual WebGui updates on Twitter Visual WebGui Page on Facebook Visual WebGui YouTube Channel Visual WebGui Platform News RSS