ASP.NET Generic Handlers & Session

Question

I have an issue with GenericHandler and anonymousIdentification.

Basically if <anonymousIdentification enabled="true" /> is turned on in the web config, whenever a JQuery GET/POST request is sent to the server, that request executes under a new user and a new user session.

Is there a way to mitigate this? I need to access the current user's session variables... It is really frustrating!

Tameika

I have not checked it but i think if you are sending a jQuery GET req. from Client then it is handled in the current user context.. check with fiddler are the ASP.net session cookie same for both normal and jquery request – Osmond

So if you turn off anonmyous ID it works? Are you using Forms auth? Can you turn off anon for that particular path in the web.config? – Digenesis

I will try and see if this works @drachenstern. You are wrong @Shekhar_Pro. I store user data in the session; one value is UserRegistratinoState. If I come from a page where the user has just registered the enum value in the session is UserRegistrationState.Registered. I have verified this. However, when I call the handler from js on the another page, the first line of code in the handler checks that session variable. If the variable doesn't exist it automatically returns UserRegistrationState.Anonymous. I think it's safe to assume that Get requests from JQuery are executing under a new user. – Tameika

What's happening is they're not sending the cookie back to the server. – Digenesis

so how do I mitigate this? which cookie do I send? and how do I send it? – Tameika

Answer 1

Generic handlers must implement the IReadOnlySessionState interface to access session variables. If you also need to write session variables, implement IRequiresSessionState.

Desmond

I will try this in a moment. Thanks @Josh Stodola – Tameika

Should read: public class MemberHandler:IHttpHandler,IRequiresSessionState – Quantifier

I had problem that handler didn't send back the session cookie if request to handler was the first to the website (no actual session id) and I thought that when IReadOnlySessionState derives from 'IRequireSessionState` that will be enought. But I really had to use IRequireSessionState explicitly . Thanks for that post. – Clarance

Answer 2

Implement the System.Web.SessionState.IRequiresSessionState interface:

public class Handler : IHttpHandler, System.Web.SessionState.IRequiresSessionState 
{   
  public void ProcessRequest(HttpContext context)  
  {      
    context.Session["StackOverflow"] = "overflowing";      
    context.Response.Redirect("~/AnotherPage.aspx");      
  }

}

Churchy

i want to get session values in generic handler to upload image against primary key that i have stored in session, i am using jquery image upload plugin and it binds all properties on document ready. i used iRequiresSessionState in my handler code but still i can't access session values. session keys are still 0. can anyone tell me about this? – Minesweeper

Answer 3

You can use this:

public class Handler : 
    IHttpHandler, 
    System.Web.SessionState.IReadOnlySessionState

Fates

Answer 4

I suggest in the web browser you enable the network tab in the developer mode. Then check in the AJAX which cookie is sent (if any).

If you do not see any cookie, it means the browser did not get any session, thus you should make sure (as stated by Josh) to inherit the right interface and access the cookie. (Don'f forget to use System.Web.SessionState)

In order to generate the cookie, access the session object's sessionID:

string sesId = context.Session.SessionID;

Before you write anything to the response.

Conradconrade

-1 It is very possible and plausible to have cookieless session state, and accessing the identifier certainly does not "generate" the cookie – Desmond