mcs/class/System.Web/System.Web.SessionState/SessionInProcHandler.cs

   1 //
   2 // System.Web.SessionState.SessionInProcHandler
   3 //
   4 // Authors:
   5 //      Stefan Görling (stefan@gorling.se)
   6 //
   7 // (C) 2003 Stefan Görling
   8 //
   9
  10 /*
  11         This is a rather lazy implementation, but it does the trick for me.
  12
  13         TODO:
  14             * Remove abandoned sessions., preferably by a worker thread sleeping most of the time.
  15             * Increase session security, for example by using UserAgent i hashcode.
  16             * Generate SessionID:s in a good (more random) way.
  17 */
  18 using System;
  19 using System.Collections;
  20
  21 namespace System.Web.SessionState
  22 {
  23         // Container object, containing the current session state and when it was last accessed.
  24         internal class SessionContainer
  25         {
  26                 private HttpSessionState _state;
  27                 private DateTime last_access;
  28
  29                 public SessionContainer (HttpSessionState state)
  30                 {
  31                         _state = state;
  32                         this.Touch ();
  33                 }
  34
  35                 public void Touch ()
  36                 {
  37                         last_access = DateTime.Now;
  38                 }
  39
  40                 public HttpSessionState SessionState {
  41                         get {
  42                                 //Check if we should abandon it.
  43                                 if (_state != null && last_access.AddMinutes (_state.Timeout) < DateTime.Now)
  44                                         _state.Abandon ();
  45
  46                                 return _state;
  47                         }
  48                         set {
  49                                 _state=value;
  50                                 this.Touch ();
  51                         }
  52                 }
  53         }
  54
  55
  56         internal class SessionInProcHandler : ISessionHandler
  57         {
  58                 protected Hashtable _sessionTable;
  59                 const string COOKIE_NAME = "ASPSESSION"; // The name of the cookie.
  60                 // The length of a session, in minutes. After this length, it's abandoned due to idle.
  61                 const int SESSION_LIFETIME = 45;
  62
  63                 public void Dispose ()
  64                 {
  65                         _sessionTable = null;
  66                 }
  67
  68                 public void Init (HttpApplication context)
  69                 {
  70                         _sessionTable = new Hashtable();
  71                 }
  72
  73
  74                 //this is the code that actually do stuff.
  75                 public bool UpdateContext (HttpContext context)
  76                 {
  77                         SessionContainer container = null;
  78
  79                         //first we try to get the cookie.
  80                         // if we have a cookie, we look it up in the table.
  81                         if (context.Request.Cookies [COOKIE_NAME] != null) {
  82                                 container = (SessionContainer) _sessionTable [context.Request.Cookies [COOKIE_NAME].Value];
  83
  84                                 // if we have a session, and it is not expired, set isNew to false and return it.
  85                                 if (container!=null && container.SessionState!=null && !container.SessionState.IsAbandoned) {
  86                                         // Can we do this? It feels safe, but what do I know.
  87                                         container.SessionState.IsNewSession = false;
  88                                         // update the timestamp.
  89                                         container.Touch ();
  90                                          // Can we do this? It feels safe, but what do I know.
  91                                         context.SetSession (container.SessionState);
  92                                         return false; // and we're done
  93                                 } else if(container!=null) {
  94                                         //A empty or expired session, lets kill it.
  95                                         _sessionTable[context.Request.Cookies[COOKIE_NAME]]=null;
  96                                 }
  97                         }
  98
  99                         // else we create a new session.
 100                         string sessionID = System.Guid.NewGuid ().ToString ();
 101                         container = new SessionContainer (new HttpSessionState (sessionID, // unique identifier
 102                                                                                 new SessionDictionary(), // dictionary
 103                                                                                 new HttpStaticObjectsCollection(),
 104                                                                                 SESSION_LIFETIME, //lifetime befor death.
 105                                                                                 true, //new session
 106                                                                                 false, // is cookieless
 107                                                                                 SessionStateMode.InProc,
 108                                                                                 false)); //readonly
 109                         // puts it in the table.
 110                         _sessionTable [sessionID]=container;
 111
 112                         // and returns it.
 113                         context.SetSession (container.SessionState);
 114                         context.Session.IsNewSession = true;
 115
 116
 117                         // sets the session cookie. We're assuming that session scope is the default mode.
 118                         context.Response.AppendCookie (new HttpCookie (COOKIE_NAME,sessionID));
 119
 120                         // And we're done!
 121                         return true;
 122                 }
 123         }
 124 }
 125