在ASP.NET MVC中处理会话超时

Question

I am working on a MVC application and I have a requirement of dealing with errors and session timeouts by redirecting the user to different error pages based on few parameters in the query string.

The issue I am facing is that i tried to implement this by saving the required parameters from querystring into a session and then redirecting to error pages. But before every HttpGet and Post action in my controllers I am checking if session is active.

So in case of a situation where session values are lost and not able to read them.

How can I implement this thing in any other way?

Answer 1

You need to check whether the session exists, has the fields you expect and is active. If the session does not exist or does not have a fields you expect, then handle the case when the session does not exist yet/expired. If it is not active, then handle the case when the session is no longer active. If everything is ok, then handle the request normally. If the session expired, then handle it as expired.

Answer 2

to check about session, you can use an ActionFilter like this:

public class SessionActiveFilterAttribute : ActionFilterAttribute
    {
        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            var activeSession = Session["user"];
            if (activeSession == null)
                //Here, do a redirect

            base.OnActionExecuting(filterContext);
        }
    }

Also, you can use a third option to save the session, like Redis Cache http://blogs.msdn.com/b/webdev/archive/2014/05/12/announcing-asp-net-session-state-provider-for-redis-preview-release.aspx

Answer 3

I know this is a dead story now. But I post this answer for the new comers. Please see the nice tutorial in codeproject about how to check session values in Action Filters.

In a dynamic web application, the session is crucial to hold the information of current logged in user identity/data. So someone without authentication cannot have access to some Page or any ActionResult, to implement this kind of functionality, we need to check session exists (is not null) in every action which required authentication.So, the general method is as follows:

[HttpGet] 
public ActionResult Home() 
{
     if(Session["ID"] == null)
         return RedirectToAction("Login","Home"); 
}

We have to check the above 2 statements each time and in each ActionResult, but it may cause 2 problems.

1. Repeat Things : As per the good programming stranded, we don't have to repeat the things. Create a module of common code and access it multiple times/repeatedly
2. Code missing : We have to write code multiple times so it might happen some time we forget to write code in some method or we missed it.

How To Avoid?

The ASP.NET MVC provides a very great mechanism ie, Action Filters. An action filter is an attribute. You can apply most action filters to either an individual controller action or an entire controller. If you want to know more about action filter, please click here .

So we will create a custom Action Filter that handles session expiration and if session is null, redirect to Login Action.

Create a new class in your project and copy the following code:

namespace YourNameSpace
{
    public class SessionTimeoutAttribute : ActionFilterAttribute
    {
        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            HttpContext ctx = HttpContext.Current;
            if (HttpContext.Current.Session["ID"] == null)
            {
                filterContext.Result = new RedirectResult("~/Home/Login");
                return;
            }
            base.OnActionExecuting(filterContext);
        }
    }
}

Now our Action Filter is created and we are ready to use it. The following code will show you how we can apply attribute to Action or to complete controller.

Apply to Action

[HttpGet]
[SessionTimeout]
public ActionResult MyProfile()
{
    return View();
}

Apply to Controller

[SessionTimeout]
public class HomeController : Controller
{
}

Now all actions of Home Controller will check for session when hit with the help of Action Filter. So we have reduced the code and repetitive things. This is the benefits of Action Filters.