Asp.Net: Retaining the old browser session after c

问题:

Is there a way I can retain the browser session after the user has closed his browser and then reopens.

The default behavior in asp.Net is that it keeps the Asp.Net SessionId in the browser cookie which expires when we close the browser. On reopen the browser asp.net generates a new SessionId and even if the old session is not expired on the server side we can not retain it.

Can we control the expiration behavior of the session cookie in Asp.Net?

回答1:

You cannot reclaim the session-id as such, but you can certainly restore some of the predictable part of the session state. If you are using forms authentication, then just read the forms-auth cookie in global.asax session start and re-populate the session objects.

You can control the expiration of forms-authentication cookie manually by creating a persistent cookie by using:

FormsAuthentication.SetAuthCookie(userName, true)

Alternatively, you can fine-tune the expiration by manually changing the cookie:

Dim authCookie As HttpCookie = FormsAuthentication.GetAuthCookie(userName)
Dim authTicket As FormsAuthenticationTicket = FormsAuthentication.Decrypt(authCookie.Value)
Dim newAuthTicket As New FormsAuthenticationTicket(authTicket.Version, authTicket.Name, authTicket.IssueDate, expireDate, authTicket.IsPersistent, userData)
authCookie.Value = FormsAuthentication.Encrypt(newAuthTicket)
authCookie.Expires = newAuthTicket.Expiration
HttpContext.Current.Response.Cookies.Set(authCookie)

Where expireDate specifies when the cookie should expire.

Now in global.asax session start you can check if the returning user is still authenticated (by virtue of persistent cookie previously set):

If HttpContext.Current.User.Identity.IsAuthenticated Then
    ' Here re-populate the predictable part of session state
    ' Like user profile etc.
End If

Added after Op insights:

Forms authentication is not being used, and the aim is to be able to just restore the previous session.

In such a case the only option is to persist the existing session by way of a persistent cookie, so that you can retrieve it later. There are some workarounds to achieve this. One of the workarounds is explained here by this blog writer:

http://weblogs.asp.net/imranbaloch/archive/2010/06/09/persisting-session-between-different-browser-instances.aspx

What is happening here is that we intercept two events in the global.asax:

1. PostRequestHandlerExecute: (Occurs when the ASP.NET event handler finishes execution) In this handler, we create a new cookie (say temp), value of which is assigned the value of current SessionId. We make it a persistent cookie by setting the expires property to the session timeout.

2. PostMapRequestHandler: (Occurs when ASP.NET has mapped the current request to the appropriate event handler) In this handler, we check the returning user by checking the existence of the "temp" cookie. If found, we update the actual session cookie (ASP.NET_SessionId) with the value of our "temp" cookie; thereby effectively restoring the previous session.

Please note that this is just a workaround. The system is designed to create a new session. All we are doing is to use a few hooks to workaround this by persisting an existing session to retrieve it later. All security implications stand.

回答2:

At the Least you can retrieve Session information. This can be done easily when you set the 'Mode' to "SqlServer".

You can Query the Database (ASPState) & hence the table (ASPStateTempSessions) where you are storing your Sessions.[ I used persistent storage: -sstype p ]

SELECT TOP 5 [SessionId]
      ,[Created]
      ,[Expires]
      ,[LockDate]
      ,[LockDateLocal]
      ,[LockCookie]
      ,[Timeout]
      ,[Locked]
      ,[SessionItemShort]
      ,[SessionItemLong]
      ,[Flags]
  FROM [ASPState].[dbo].[ASPStateTempSessions]

Even if you know your sessionID, you may use it to restore your previous session. Asp.Net will generate a new SessionID when you do a new request.