FormsAuthentication.RedirectToLoginPage（）什么都不做

Question

I have the following problem: republishing ASP.NET web app causes (as expected) session resetting where I keep additional user info (what on access attempt will cause NullReferenceException).

To avoid that, my page checks this info existence and in case of null redirects user to the login page (forms auth), so I'm calling:

void LogOut()
{
    Session.Clear();
    Session.Abandon();
    User = null;
    FormsAuthentication.SignOut();
    FormsAuthentication.RedirectToLoginPage()
}

But sometimes it doesn't help, so I found a workaround:

Response.Redirect(FormsAuthentication.LoginUrl);

but it doesn't add returnUrl, what I wish it were (I don't want to emulate this behavior manually).

So want to figure out why does the first way doesn't work as expected.

Answer 1

您是否尝试过在FormsAuthentication.RedirectToLoginPage()之后调用Response.End() FormsAuthentication.RedirectToLoginPage() ？

Answer 2

I have the following problem: republishing ASP.NET web app causes (as expected) session resetting where I keep additional user info (what on access attempt will cause NullReferenceException).

But sometimes it doesn't help

I'm not sure what you mean by "sometimes it doesn't help" - you don't say what exactly happens.

But you should remember that expiration of a Forms Authentication ticket and expiration of a Session timeout are completely independent. A user's session can timeout while his Forms Authentication ticket is still valid and vice versa.

In general, when accessing data from Session, you should always test for existence first, and refresh it if necessary:

object o = Session["Whatever"];
if (o == null)
{
    o = ... refresh it e.g. from the database
    Session["Whatever"] = o;
}
...

Often it's useful to use a helper class to encapsulate this.

In your case you refer to "additional user info" - so you'll probably be able to retrieve this using HttpContext.Current.User.Identity.Name as a key.

Forcing a user to log in again because a Session has expired, eg because of an Application Pool recycle on the server, is very unfriendly.

UPDATE

The MSDN documentation for RedirectToLoginPage states that:

Unlike the HttpResponse.Redirect method, this method does not end the request by calling HttpResponse.End. This means that code that follows the RedirectToLoginPage method call will run.

This probably explains what you're seeing: code in the Page life cycle after your call to RedirectToLoginPage is running, and throwing a NullReferenceException .

You could call Response.End after RedirectToLoginPage to avoid this.

My Session timeout set = Forms auth timeout (via web.config).

I would re-iterate that Session expiry and FormsAuthentication expiry are unrelated, even if the timeouts happen to be the same. A FormsAuthentication cookie will survive an application pool recycle on the server; a Session will not.