The Wanderer

I kept running into the situation where a user's session would timeout and cause my web applications to work differently then they expected (for instance redirecting them to the login page instead of saving the form with changes they made and left up over night). While it's temping to say, "well, yeah, that's how web applications work," but I've always thought there should be some simple solution that doesn't require explaining session timeouts to the user.

I think I finally found one. I call it session pinging.

At first I thought about using AJAX (Asynchronous Javascript And Xml) to do this, but I wanted to make sure this worked for a wider selection of browsers. Plus, I had to need to feedback from the server, so AJAX seemed like it might be too much overhead for the simple need I was trying to meet. My solution began with a brilliant little AJAX alternative I found at dotvoid.com.

function callServer(remoteScript) {
	try {
		var head = document.getElementsByTagName('head').item(0);
		var old  = document.getElementById('lastLoadedCmds');
		if (old) head.removeChild(old);
		script = document.createElement('script');
		script.src = remoteScript;
		script.type = 'text/javascript';
		script.defer = true;
		script.id = 'lastLoadedCmds';
		void(head.appendChild(script));
		return true;
	} catch (e) {
		//suppress
	}
	return true;
}

This ingenious function looks for a <script> tag in the header with and ID of lastLoadedCmds and removes it if it already exists. Then it adds a new <script> tag with the same ID and points it at a provided URL. This causes the browser to go to the URL behind-the-scenes to download it. If you specify a server-side script (ASP, ASPX, etc) instead of a static text file (.js, etc) you can run server-side, database-driven code without reloading the page. You can even have the callback page generate javascript code on-the-fly that will have some effect on the calling page (load a dropdown with values, put html into a place holder div, etc.). In other words, basically do similar things AJAX does.

Now all we have to do in an ASP.NET application to keep session alive is have every page intermitently hit any .ASPX page on the server. EvintermittentlyerytEvery timeime this happens the session-end time is pushed back another 20 minutes (or whatever timeout you've set). This type of intermittent action can easily be done in JavaScript with the setInterval() method.

var pingTimer;

function setPingServer(timeout) {
	pingTimer = setInterval('callServer(\'/PingServer.aspx\');', timeout);
}

function killClock() {
	clearInterval(pingTimer);
}

Now just finish up by calling the setPingServer() method in the page's onload event. Make sure you clean up the interval you set when the user leaves the page.

<body onload="setPingServer(30000)" onunload="killClock()">

This would also be a great solution to controlling the number of logged-in users for the purposes of licensing. In that case, just change your PingServer.aspx page to log each distinct user somewhere so you can keep a count of distinct active users.

Programming

11/3/2005 11:42:39 AM (Eastern Standard Time, UTC-05:00)

Comments [1] | Trackback

11/11/2005 9:42:37 AM (Eastern Standard Time, UTC-05:00)

Great solution. Remember to exclude PingServer.aspx from your IIS logs (you can put it in it's own directory and turn off logging in IIS).