Question

I’m trying to create a log when an authenticated user creates a new session, but for some reason I’ve run into odd behavior. For testing I set my Session timeout to 2 minutes in web.config:

<sessionState cookieName="AppName_SessionId" timeout="2" />   

And in Global.asax.vb I have the following code to log:

Sub Session_Start(ByVal sender As Object, ByVal e As EventArgs)

   If My.User.IsAuthenticated = True Then
      Log.Create()
   End If
End Sub

Everything works correctly after I login, close the browser and reopen it. It only logs once while I visit pages while I’m in the session. The problem is when I stop and let the session expire (2 minutes for testing) and try again. It logs the new session, which is the behavior I expect, but then the Session_Start is fired on every page view thereafter. I confirmed this on different browsers.

It appears that once the session has expired and the browser is still open, that it cannot maintain the session.

Answer 1

My fix was to add something to the Session:

Sub Session_Start(ByVal sender As Object, ByVal e As EventArgs) 

   If My.User.IsAuthenticated = True Then 
      Log.Create() 
      Session("SessionLogged") = True
   End If 

End Sub