We have a web site that consists of several Web apps entered from a menu page. This menu page handles the credentials and passes the ID of the user to the variaous Web Apps by means of a session variable. When the session dies none of the pages will open, those that are open will not submit, and the user will be redirected to a timeout page.
The customer would like some kind of timeout notification. I've seen many tools available and tested many of them. But each of them needs to be on the active window to actually count down the session because they are using a local timer. When this is not done it results in the notification being shown on the menu window even though the session is still alive and well because of work being done in the web app's window. I thought I had found a method from http://stackoverflow.com/a/7029210/1161391 where an AJAX pagemethod was being used to do a call back to a webmethod, that polls the server to check if its session has timed out. But as it seemingly turned out, the WebMethod merely carried out a calculation of the time since the session was initially created so that call back merely established whether the originally set timeout period had passed since the session was initiated. It did not actually perform a check to see if the session had actually timed out. In addition, some of my experiments seemed to show that even though the session had austensibly died, it had in fact not died and was alive and well, making me wonder whether the call backs to webmethod on the server every thirty seconds was in fact keeping the session alive.
We really don't want to have to update all 1700 pages in the various web apps to include timeout notification controls or code. So i would be interested to know if your notification control could be posted on the menu page and then provide the notification of session timeout for each of the different web apps.
3 Answers, 1 is accepted
The reason why all methods you see are client-side is that requests to the server to check the session will actually renew the session, which is rarely desired, thus you need to have a client-side timer that is set according to the server-side value. The other thread you posted in also contains information about this scenario and its limitations when multiple windows/tabs are used - the simple fact that synchronization between the pages is hardly possible. Requests to the server also renew the session as I explained in the other thread, so the appraoch with pinging the server every 30 seconds will effectively result in a infinite (as long as the user keeps the page opened) session.
What I can suggest in your case is that you keep the user in the same page and use, for example the RadSplitter control to show subsequent pages in a middle pane (where all the navigation and user interaction will take place) while allowing you to place the RadNotification control in the common page/Master page to alert the user about the session. A master page + content pages is a better option as you will again have a common header/footer + notification and will avoid iframes; moreover the master page intertwines with the content pages and you can keep the RadNotification updated all the time by simply placing it in an UpdatePanel with UpdateMode=Always so that each AJAX requests that renews the session will also reset the notification timer. If this is your scenario - then yes, a single notification in the master page can be used for all content pages.
Regards,
Marin Bratanov
the Telerik team
Rank 1
I would like to correct the information I provided on the original post as I was mis-informed about the set-up. The Menu page or portal, and each of the modules called are in fact separate web applications with separate session states. So that simplifies things in part as each will need to have it separate notification. Therefore the only issue is for child pages called from within a web application. Now another notification device suggested using a page load event on a child page have each child page refresh call the reset function on the parent page when it reloads by using something like window.opener.PreserveSession() (which is the JavaScript function that carries out the session refresh), which would cause a session referesh of the parent page each time the child page reloads. I've tried it in a couple of JQuery implementations and it works well. It even opened on top of the child page so that there was no question of visibility. Could something similar be done using the Notification tool? Maybe something like window.opener.ContinueSession()?
One confusion I have concerns AJAX call backs versus MS AJAX partial postbacks. As I understand it real AJAX call backs do not automatically refresh the session whereas MS AJAX partial postbacks do? So putting the notification within an update panel will utilize the partial postback of the update panel to refresh the session.
Update: I note that some of these tools have to add a onload event handler which accesses the Sys.WebForms.PageRequestManager's add_endevent method to set a function that fires on the request end event of a partial postback. Seems to me that the Telerik Notification would require something similar in order to reinitialize the local page timer after an asynchronous post back.
The tool I saw that checked the used an AJAX callback to check a web method on the server every thirty seconds did so to determine when the time elapsed since a time established in the session_start event, exceeded the session timeout. However, experimentation led me to question whether it was in fact reporting truly that the session had timed out. I would need to experiment further to determine the actual facts in this matter.
The ContinueSession() JavaScript function can be called when you need to renew the session. It invokes the RadNotification's callback. Using window.opener to get a reference to the browser window that opened your current page can be a way of getting this reference, but if you have different applications they may be in different domains and JavaScript may not allow this call.
Regarding session renewal - there is a lot of information in the net on the matter, for example:
this google search
this MSDN blog
this article
this article
I also prepared a small sample for you that renews the session by using the notification callbacks. Just remove the notification from the page, wait for the session to time out and see the difference when posting back the page. This is an example web.config setting:
<authentication mode="Forms"> <forms loginUrl="login.aspx" timeout="1"></forms> </authentication>In my sample without the notification the Session[] object is lost and a redirect to the login page takes place if the postback is more than 1 minute after the page load. With the notification in place callbacks are performed that renew the session and thus simply a postback happens.
All the best,
Marin Bratanov
the Telerik team