如何获取 Web 应用程序中的活动会话列表？

Question

I am trying to get a list of active session id's in my web application.

I tried to manage a list in Global.asax. I add session id when Session_Start is fired, and remove session id when Session_End is fired.

The problem is in cases when the user closes the browser or shut down the computer. The Session_End is not fired, and the seesion still exists in the list.

Somebody has an idea how can I get the list?

Thanks!

Answer 1

There is no solution to this problem that avoids the complication you note. Unless there is some explicit way to end a user's session - and the user activates it - the only way to know when a session has ended is to allow it to expire.

Session_End will eventually fire, when the session times out. The only time you never see Session_End called is when the application domain itself unexpectedly quits. In such a case, you know that all of your sessions are dead, anyway.

Answer 2

Andrew Barber is correct. There is just one more thing you can do:

• Ask your users to logout. In fact not just ask them but in a way force/remind them that they have to log out.

Here is how i did it:

<script type="text/javascript">
    $(function () {
        $("a").click(function () {
            window.onbeforeunload = null;
        });
    }); 
</script>

<script type="text/javascript">
    window.onbeforeunload = confirmExit;
    function preConfirm() {
        if ((window.event.clientX < 0) || (window.event.clientY < 0)) {
            confirmExit();
        }
    }
    function confirmExit() {
        return "You have attempted to leave this page.  It is suggested to log out using the link.  Are you sure you want to exit this page?";
    }
</script>

By adding these scripts to your master page (if that is the case or in every page) the browser prompts the user with a modal window with your message if they try to load another page or close the browser without logging off.

Of course the user my decide to leave the page anyway even though you remind him to log off but really you have tried your best!!

Answer 3

If you use a SQL Server database to store your sessions in it becomes easier to retrieve what appears to be currently active by using an SQL query to get what you need.

I say appears because like others have noted sessions can hang around if they are not properly cleared using Session.Abandon() eg if the user just closes their browser window without logging out. This means that you can only rely on the expiry date of the session to be sure the session is completely finished with, however long you have set that to be.

I should also point out that if you do use a database as your session store, the Session_End event will never fire.