Re: Is Session Always Cleared?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Jonathan Wood explained :
Thanks for the additional vote of confidence on Session.

There is a slight possibility that at least one of the users did log on as other users. I will quiz them on if they might have logged on as the users whose data they saw when they logged on as themselves.

I don't know that's the issue but I'll explore it. Is there as straight forward way to allow multiple users to log on from the same computer?

Jonathan


What exactly do you mean by "multiple users logging in from the same computer"?

If there is just one user at a time then there shouldn't be a problem.
If the first user closes his browser after he is finished, the session cookie is forgotten. A new browser instance will use a new session.
When the first user logs out, you can destroy the session server side (Session.Abandon).

However, two users at *the same time* from the same computer could lead to problems. The various browser windows could use the same cookie set. So when a second user opens a new window, he could be automatically using the session of the first user.

I think that firefox uses the same cookieset for all it's windows. For IE it depends on how the new window is started.

Hans Kesting


.

Relevant Pages

  • Re: _SESSION weirdness behind a NAT firewall/router: bug?
    ... that the 'sess_deleted' file is actually being used as a session ID. ... force the cookie to expire. ... Any $_SESSION values introduced by one browser become part of the ... I re-load the non-logged-in index page in Opera. ...
    (comp.lang.php)
  • Re: php session without cookie useage
    ... >>> browser or the application to maintain the state if needed. ... >>> transfer a session key created on login to subsequent pages via a POST ... >>> browser via a cookie or via POST or GET. ... > That may block legitimate users using a round-robin proxy (different ...
    (comp.lang.php)
  • Re: Is Session Always Cleared?
    ... If the first user closes his browser after he is finished, the session cookie is forgotten. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Detecting loss of session
    ... > a request. ... From what I've read on session cookies ... > sending) them as soon as they expire, not when the browser is closed? ... If you don't set the expiration on a Cookie, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Cookies , Session Which is Better ? and Global.asa Question
    ... YOU SHOULD NEVER STORE PERSONALLY IDENTIFIABLE INFORMATION IN A ... If you needed to store personal information in a cookie use non ... impossible - its much harder for me to hijack session information from ... The average time a session lasts is 20 mins. So, when your browser ...
    (microsoft.public.inetserver.asp.general)