Question

I am wondering what is the best (e.g. most efficient, commonly accepted, industry standard) way to deal with the potential expiration of a session when you are regularly using the values stored in it in your code.

For example, I am often using (in C#) lines similar to the following:

Guid personGuid = (Guid)Session[SSPersonGuid];

I am checking in Page_Load whether the values are null and dealing accordingly, but the session might expire while the person is on the page, in which case when they click a button on the page, and we need to use something like the above, there will be a NullReferenceException.

Is the best way to handle this just to check for null before each usage like this:

if (Session[SSPersonGuid] == null) {...}

Or is there some kind of special thing I don’t know about?

Answer 1

What is the best (e.g. most efficient, commonly accepted, industry
standard) way to deal with the potential expiration of a session?

The best would be that they dont expire by setting up a Out-Of-Process session state server or out-of-process SQL Server.

Also you may detect it in the The Session_OnEnd Event

EDIT:

Something Jeff Atwood says here corresponds with Scotts answer: http://www.codinghorror.com/blog/2008/04/your-session-has-timed-out.html

I am inundated with session timeout messages every day from a variety
of sources, but I’ve never once seen a session expiration message from
gmail, for example. Here’s what I suggest:

1. Create a background JavaScript process in the browser that sends
   regular heartbeats to the server. Regenerate a new cookie with timed
   expiration, say, every 5 or 10 minutes.

2. If you’re worried about
   session hijacking — and you really should be — use a HTTPS protected
   connection. This is an absolute no-brainer for financial institutions
   of any kind.