Showing posts with label url. Show all posts
Showing posts with label url. Show all posts

Saturday, March 31, 2012

Session tracked via URL in ASP.NET

Hello,

I have my asp.net web application to track session id across pages using the url, and not cookies, ie in the web.config file:
<sessionState .... cookieless="true" ...... />

however each link in the page does not embed the id in the url like it is supposed to :

<a href="http://links.10026.com/?link=http://mywebserver/(rqe4ptb333ojxz3kh1t3xqr3)/mypage.aspx"> my link </a>

and so each page i travel to, a new session id is created in the url and the information associated with the previous page's session id is lost.

can anybody tell me what else i need to do to make this work?

thank you,

Kenton Taylorfor some reason the .net framework will not insert the session id before rendering the HTML if your HREF uses a "/" to denote that the path is relative to the root

this will work:
href="http://myserver/home.aspx"

as will this:
href="home.aspx"

but this won't:
href="/home.aspx"

Session URL Formatting

Hello,

I have a problem with ASP.Net:

I have an ASP.Net application on a web farm, using SQL Server Session
State Management, running on Windows 2000 (IIS 5)
With session management on, a URL like the following is created:
https://mywebapp.com/(ts2t2uivrj3vx...cvg)/start.aspx
The problem I am having is that at some point within the web application
I have to pass this link to an outside server, which in turn,
will do some work and then post back to my application. However, the
outside application is URL Encoding my URL, which in turn,
causes the URL to look like:
mywebapp.com/(suyvga3bcnzwrljiaxdfud30)/vbvnet.aspx
This cannot be handled by IIS, and induces a "page cannot be displayed
error"; which in effect, causes the application to terminate.

Is there any way that we can trap this error and redirect to the appropriate
location so that the web application does terminate, or is there a way
we can prevent the brackets within this application.

Hope I explained this correctly.

Appreciate any help.

Regards,

Malcolm KlotzOne approach - not clean - you can catch the IIS error code 404 and then
handle the issue on a redirect page. Sorry, I can't think of anything
cleaner at the moment.

--
Regards,
Alvin Bruney - ASP.NET MVP

[Shameless Author Plug]
The Microsoft Office Web Components Black Book with .NET
Now available @. www.lulu.com/owc, Amazon.com etc
"Malcolm Klotz" <nonesuch23@.online.nospam> wrote in message
news:OvlaLxATFHA.2812@.TK2MSFTNGP09.phx.gbl...
> Hello,
> I have a problem with ASP.Net:
> I have an ASP.Net application on a web farm, using SQL Server Session
> State Management, running on Windows 2000 (IIS 5)
> With session management on, a URL like the following is created:
> https://mywebapp.com/(ts2t2uivrj3vx...cvg)/start.aspx
> The problem I am having is that at some point within the web
> application
> I have to pass this link to an outside server, which in turn,
> will do some work and then post back to my application. However, the
> outside application is URL Encoding my URL, which in turn,
> causes the URL to look like:
> mywebapp.com/(suyvga3bcnzwrljiaxdfud30)/vbvnet.aspx
> This cannot be handled by IIS, and induces a "page cannot be displayed
> error"; which in effect, causes the application to terminate.
> Is there any way that we can trap this error and redirect to the
> appropriate
> location so that the web application does terminate, or is there a way
> we can prevent the brackets within this application.
> Hope I explained this correctly.
> Appreciate any help.
> Regards,
> Malcolm Klotz
Thanks for Alvin's inputs,

Hi Malcolm,

Since you are using the cookieless Session(embed sessionid in the url
string) in your web app, is there any particular requirement in your
scenario that we must use cookieless session? Is it possbile that we use
cookieenabled session instread?

Also, as for passing the url to a outside server, I think we have the
following means:

1. If we are forced to use cookieless session and with the sessionid
embeded in the url, I suggest that we filter the sessionid when pass the
url out to the remote server. For example:

when giving the following url

https://mywebapp.com/(ts2t2uivrj3vx...cvg)/start.aspx

we can use substring concating or regex to get the url without embeded
sessionid like:

https://mywebapp.com/start.aspx

this can also work for the remote requster, the only difference is that the
request with non-sessionid url will be unable to retrieve the data in the
SessionState associated with the id. Do you think this means possbile?

2. If we also want to let the remote server be able to retrieve the
sessiondata, I suggest that we still pass the urlstring without embeded
sessionid , but also pass the SessionId string as separate data to that
remote server together with the url string. How do you think of this?

Please feel free to post here if you have any other questions or ideas.
Thanks,

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
Thank you, you have given me a place to start.

"Steven Cheng[MSFT]" <v-schang@.online.microsoft.com> wrote in message
news:eSJz3kGTFHA.2476@.TK2MSFTNGXA01.phx.gbl...
> Thanks for Alvin's inputs,
> Hi Malcolm,
> Since you are using the cookieless Session(embed sessionid in the url
> string) in your web app, is there any particular requirement in your
> scenario that we must use cookieless session? Is it possbile that we use
> cookieenabled session instread?
> Also, as for passing the url to a outside server, I think we have the
> following means:
> 1. If we are forced to use cookieless session and with the sessionid
> embeded in the url, I suggest that we filter the sessionid when pass the
> url out to the remote server. For example:
> when giving the following url
> https://mywebapp.com/(ts2t2uivrj3vx...cvg)/start.aspx
> we can use substring concating or regex to get the url without embeded
> sessionid like:
> https://mywebapp.com/start.aspx
> this can also work for the remote requster, the only difference is that
the
> request with non-sessionid url will be unable to retrieve the data in the
> SessionState associated with the id. Do you think this means possbile?
> 2. If we also want to let the remote server be able to retrieve the
> sessiondata, I suggest that we still pass the urlstring without embeded
> sessionid , but also pass the SessionId string as separate data to that
> remote server together with the url string. How do you think of this?
> Please feel free to post here if you have any other questions or ideas.
> Thanks,
> Regards,
> Steven Cheng
> Microsoft Online Support
> Get Secure! www.microsoft.com/security
> (This posting is provided "AS IS", with no warranties, and confers no
> rights.)
You're welcome Malcolm,

Good luck! :-)

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

Thursday, March 29, 2012

Session URL Formatting

Hello,
I have a problem with ASP.Net:
I have an ASP.Net application on a web farm, using SQL Server Session
State Management, running on Windows 2000 (IIS 5)
With session management on, a URL like the following is created:
https://mywebapp.com/(ts2t2uivrj3vxg452ah33cvg)/start.aspx
The problem I am having is that at some point within the web application
I have to pass this link to an outside server, which in turn,
will do some work and then post back to my application. However, the
outside application is URL Encoding my URL, which in turn,
causes the URL to look like:
mywebapp.com/(suyvga3bcnzwrljiaxdfud30)/vbvnet.aspx
This cannot be handled by IIS, and induces a "page cannot be displayed
error"; which in effect, causes the application to terminate.
Is there any way that we can trap this error and redirect to the appropriate
location so that the web application does terminate, or is there a way
we can prevent the brackets within this application.
Hope I explained this correctly.
Appreciate any help.
Regards,
Malcolm KlotzOne approach - not clean - you can catch the IIS error code 404 and then
handle the issue on a redirect page. Sorry, I can't think of anything
cleaner at the moment.
Regards,
Alvin Bruney - ASP.NET MVP
[Shameless Author Plug]
The Microsoft Office Web Components Black Book with .NET
Now available @. www.lulu.com/owc, Amazon.com etc
"Malcolm Klotz" <nonesuch23@.online.nospam> wrote in message
news:OvlaLxATFHA.2812@.TK2MSFTNGP09.phx.gbl...
> Hello,
> I have a problem with ASP.Net:
> I have an ASP.Net application on a web farm, using SQL Server Session
> State Management, running on Windows 2000 (IIS 5)
> With session management on, a URL like the following is created:
> https://mywebapp.com/(ts2t2uivrj3vxg452ah33cvg)/start.aspx
> The problem I am having is that at some point within the web
> application
> I have to pass this link to an outside server, which in turn,
> will do some work and then post back to my application. However, the
> outside application is URL Encoding my URL, which in turn,
> causes the URL to look like:
> mywebapp.com/(suyvga3bcnzwrljiaxdfud30)/vbvnet.aspx
> This cannot be handled by IIS, and induces a "page cannot be displayed
> error"; which in effect, causes the application to terminate.
> Is there any way that we can trap this error and redirect to the
> appropriate
> location so that the web application does terminate, or is there a way
> we can prevent the brackets within this application.
> Hope I explained this correctly.
> Appreciate any help.
> Regards,
> Malcolm Klotz
>
Thanks for Alvin's inputs,
Hi Malcolm,
Since you are using the cookieless Session(embed sessionid in the url
string) in your web app, is there any particular requirement in your
scenario that we must use cookieless session? Is it possbile that we use
cookieenabled session instread?
Also, as for passing the url to a outside server, I think we have the
following means:
1. If we are forced to use cookieless session and with the sessionid
embeded in the url, I suggest that we filter the sessionid when pass the
url out to the remote server. For example:
when giving the following url
https://mywebapp.com/(ts2t2uivrj3vxg452ah33cvg)/start.aspx
we can use substring concating or regex to get the url without embeded
sessionid like:
https://mywebapp.com/start.aspx
this can also work for the remote requster, the only difference is that the
request with non-sessionid url will be unable to retrieve the data in the
SessionState associated with the id. Do you think this means possbile?
2. If we also want to let the remote server be able to retrieve the
sessiondata, I suggest that we still pass the urlstring without embeded
sessionid , but also pass the SessionId string as separate data to that
remote server together with the url string. How do you think of this?
Please feel free to post here if you have any other questions or ideas.
Thanks,
Regards,
Steven Cheng
Microsoft Online Support
Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)
Thank you, you have given me a place to start.
"Steven Cheng[MSFT]" <v-schang@.online.microsoft.com> wrote in message
news:eSJz3kGTFHA.2476@.TK2MSFTNGXA01.phx.gbl...
> Thanks for Alvin's inputs,
> Hi Malcolm,
> Since you are using the cookieless Session(embed sessionid in the url
> string) in your web app, is there any particular requirement in your
> scenario that we must use cookieless session? Is it possbile that we use
> cookieenabled session instread?
> Also, as for passing the url to a outside server, I think we have the
> following means:
> 1. If we are forced to use cookieless session and with the sessionid
> embeded in the url, I suggest that we filter the sessionid when pass the
> url out to the remote server. For example:
> when giving the following url
> https://mywebapp.com/(ts2t2uivrj3vxg452ah33cvg)/start.aspx
> we can use substring concating or regex to get the url without embeded
> sessionid like:
> https://mywebapp.com/start.aspx
> this can also work for the remote requster, the only difference is that
the
> request with non-sessionid url will be unable to retrieve the data in the
> SessionState associated with the id. Do you think this means possbile?
> 2. If we also want to let the remote server be able to retrieve the
> sessiondata, I suggest that we still pass the urlstring without embeded
> sessionid , but also pass the SessionId string as separate data to that
> remote server together with the url string. How do you think of this?
> Please feel free to post here if you have any other questions or ideas.
> Thanks,
> Regards,
> Steven Cheng
> Microsoft Online Support
> Get Secure! www.microsoft.com/security
> (This posting is provided "AS IS", with no warranties, and confers no
> rights.)
>
You're welcome Malcolm,
Good luck! :-)
Regards,
Steven Cheng
Microsoft Online Support
Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

Tuesday, March 13, 2012

Session variables dropped using Redirect

I cannot get a session to stay active between web pages. I initialize a
Session with variables and then execute a Response.Redirect(url,false); The
called web page has a different sessionid that the page which sent the
response. I have my sessionstate set to:
<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;user id=sa;password="
cookieless="false" timeout="20"/>
and both webpages are in the same application. My system was working for
over 2 years and now all of a sudden it drops a session whenever I go from
one webpage to another. Does anyone have a clue as to what to check for
next?Session is based on cookies sent by the browser
so if you are redirecting from www.mydomain.com to mudomain.com, to
ASP.NET that's two separate sites even though it's on the same machine and
the same IIS Application. But it could be a lot of other things too,
application restarts, etc. You could get Fiddler and scope around in the
requests, that might give you a clue by examining the headers.
The other thing to think about is "what has changed on my machine recently".
Peter
Co-founder, Eggheadcafe.com developer portal:
http://www.eggheadcafe.com
UnBlog:
http://petesbloggerama.blogspot.com
"Parrot" wrote:

> I cannot get a session to stay active between web pages. I initialize a
> Session with variables and then execute a Response.Redirect(url,false); T
he
> called web page has a different sessionid that the page which sent the
> response. I have my sessionstate set to:
> <sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424"
> sqlConnectionString="data source=127.0.0.1;user id=sa;password="
> cookieless="false" timeout="20"/>
> and both webpages are in the same application. My system was working for
> over 2 years and now all of a sudden it drops a session whenever I go from
> one webpage to another. Does anyone have a clue as to what to check for
> next?
>
Peter;
Thanks for your reply. I have checked everything out that I can think of.
It happens using both IE and Firefox so its not the browser. Cookies are
turned on and I have not made any changes to IIS. The system works on my IS
P
but not on my machine which is a clue but I don't know what to check next.
It really is frustrating and I am thinking of passing data in querystrings
but I can't figure out how to encrypt the data since it is secure data.
What is Fiddler?
"Peter Bromberg [C# MVP]" wrote:
> Session is based on cookies sent by the browser
> so if you are redirecting from www.mydomain.com to mudomain.com, to
> ASP.NET that's two separate sites even though it's on the same machine and
> the same IIS Application. But it could be a lot of other things too,
> application restarts, etc. You could get Fiddler and scope around in the
> requests, that might give you a clue by examining the headers.
> The other thing to think about is "what has changed on my machine recently
".
> Peter
>
>
> --
> Co-founder, Eggheadcafe.com developer portal:
> http://www.eggheadcafe.com
> UnBlog:
> http://petesbloggerama.blogspot.com
>
>
> "Parrot" wrote:
>

Session variables dropped using Redirect

I cannot get a session to stay active between web pages. I initialize a
Session with variables and then execute a Response.Redirect(url,false); The
called web page has a different sessionid that the page which sent the
response. I have my sessionstate set to:

<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;user id=sa;password="
cookieless="false" timeout="20"/>

and both webpages are in the same application. My system was working for
over 2 years and now all of a sudden it drops a session whenever I go from
one webpage to another. Does anyone have a clue as to what to check for
next?Session is based on cookies sent by the browser

so if you are redirecting from www.mydomain.com to mudomain.com, to
ASP.NET that's two separate sites even though it's on the same machine and
the same IIS Application. But it could be a lot of other things too,
application restarts, etc. You could get Fiddler and scope around in the
requests, that might give you a clue by examining the headers.

The other thing to think about is "what has changed on my machine recently".
Peter

--
Co-founder, Eggheadcafe.com developer portal:
http://www.eggheadcafe.com
UnBlog:
http://petesbloggerama.blogspot.com
"Parrot" wrote:

Quote:

Originally Posted by

I cannot get a session to stay active between web pages. I initialize a
Session with variables and then execute a Response.Redirect(url,false); The
called web page has a different sessionid that the page which sent the
response. I have my sessionstate set to:
>
<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;user id=sa;password="
cookieless="false" timeout="20"/>
>
and both webpages are in the same application. My system was working for
over 2 years and now all of a sudden it drops a session whenever I go from
one webpage to another. Does anyone have a clue as to what to check for
next?
>
>


Peter;
Thanks for your reply. I have checked everything out that I can think of.
It happens using both IE and Firefox so its not the browser. Cookies are
turned on and I have not made any changes to IIS. The system works on my ISP
but not on my machine which is a clue but I don't know what to check next.
It really is frustrating and I am thinking of passing data in querystrings
but I can't figure out how to encrypt the data since it is secure data.
What is Fiddler?

"Peter Bromberg [C# MVP]" wrote:

Quote:

Originally Posted by

Session is based on cookies sent by the browser
>
so if you are redirecting from www.mydomain.com to mudomain.com, to
ASP.NET that's two separate sites even though it's on the same machine and
the same IIS Application. But it could be a lot of other things too,
application restarts, etc. You could get Fiddler and scope around in the
requests, that might give you a clue by examining the headers.
>
The other thing to think about is "what has changed on my machine recently".
Peter
>
>
>
>
>
--
Co-founder, Eggheadcafe.com developer portal:
http://www.eggheadcafe.com
UnBlog:
http://petesbloggerama.blogspot.com
>
>
>
>
"Parrot" wrote:
>

Quote:

Originally Posted by

I cannot get a session to stay active between web pages. I initialize a
Session with variables and then execute a Response.Redirect(url,false); The
called web page has a different sessionid that the page which sent the
response. I have my sessionstate set to:

<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;user id=sa;password="
cookieless="false" timeout="20"/>

and both webpages are in the same application. My system was working for
over 2 years and now all of a sudden it drops a session whenever I go from
one webpage to another. Does anyone have a clue as to what to check for
next?