Question

I’m in the middle of trying to fix my session timeout code, and have run into an interesting problem. I’ve taken the recommendations here and here to assume I’ve hit a timeout when Session.IsNewSession is true and a session cookie already exists. According to multiple posts, these are signs that a timeout has occurred. All of these checks I have on my homepage before the user logs in (they’re redirected to this page in timeout and logout situations).

So let’s assume that’s all correct. When the user clicks LogOut in the application, I run my necessary database code to end the session, then I run this:

//abandon session
Global.Session.Abandon();

//redirect
Response.Redirect(FormsAuthentication.LoginUrl, false);

What I noticed immediately in my homepage, when I’m performing the session timeout checks, was that Session.IsNewSession was true, eventually leading to the logic that thinks there’s a session timeout. Obviously it wasn’t; the user just clicked Log Out. By putting a breakpoint in Session_End in my Global file, I was able to see that Session_End is fired after I do the Response.Redirect() statement when the user logs off.

So I’m wondering if that’s supposed to happen? Originally I thought that it had something to do with Session.Abandon(), but that doesn’t seem to be causing Session_End to fire. Any ideas?

Thanks.

Answer 1

The Session_End event is fired only after the current request completes. The redirect is the end of your request, so the event fires at that time. A Redirect by itself does not end the current session.