mcs/class/System.Web/System.Web.SessionState_2.0/SessionIDManager.cs

   1 //
   2 // System.Web.Compilation.SessionStateItemCollection
   3 //
   4 // Authors:
   5 //   Marek Habersack (grendello@gmail.com)
   6 //
   7 // (C) 2006 Marek Habersack
   8 //
   9
  10 //
  11 // Permission is hereby granted, free of charge, to any person obtaining
  12 // a copy of this software and associated documentation files (the
  13 // "Software"), to deal in the Software without restriction, including
  14 // without limitation the rights to use, copy, modify, merge, publish,
  15 // distribute, sublicense, and/or sell copies of the Software, and to
  16 // permit persons to whom the Software is furnished to do so, subject to
  17 // the following conditions:
  18 //
  19 // The above copyright notice and this permission notice shall be
  20 // included in all copies or substantial portions of the Software.
  21 //
  22 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  23 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  24 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  25 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  26 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  27 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  28 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  29 //
  30 #if NET_2_0
  31 using System.Security.Cryptography;
  32 using System.Web;
  33 using System.Web.Configuration;
  34 using System.Web.Util;
  35
  36 namespace System.Web.SessionState
  37 {
  38         public class SessionIDManager : ISessionIDManager
  39         {
  40                 SessionStateSection config;
  41
  42                 public SessionIDManager ()
  43                 {
  44                 }
  45
  46                 public static int SessionIDMaxLength {
  47                         get { return 80; }
  48                 }
  49
  50                 // Todo: find use for the context parameter?
  51                 public virtual string CreateSessionID (HttpContext context)
  52                 {
  53                         return SessionId.Create ();
  54                 }
  55
  56                 public virtual string Decode (string id)
  57                 {
  58                         return HttpUtility.UrlDecode (id);
  59                 }
  60
  61                 public virtual string Encode (string id)
  62                 {
  63                         return HttpUtility.UrlEncode (id);
  64                 }
  65
  66                 public string GetSessionID (HttpContext context)
  67                 {
  68                         string ret = null;
  69
  70                         if (SessionStateModule.IsCookieLess (context, config)) {
  71                                 string tmp = context.Request.Headers [SessionStateModule.HeaderName];
  72                                 if (tmp != null)
  73                                         ret = Decode (tmp);
  74                         } else {
  75                                 HttpCookie cookie = context.Request.Cookies [config.CookieName];
  76                                 if (cookie != null)
  77                                         ret = Decode (cookie.Value);
  78                         }
  79
  80                         if (ret != null && ret.Length > SessionIDMaxLength)
  81                                 throw new HttpException ("The length of the session-identifier value retrieved from the HTTP request exceeds the SessionIDMaxLength value.");
  82                         if (!Validate (ret))
  83                                 throw new HttpException ("Invalid session ID");
  84
  85                         return ret;
  86                 }
  87
  88                 public void Initialize ()
  89                 {
  90                         config = WebConfigurationManager.GetSection ("system.web/sessionState") as SessionStateSection;
  91                 }
  92
  93                 public bool InitializeRequest (HttpContext context, bool suppressAutoDetectRedirect, out bool supportSessionIDReissue)
  94                 {
  95                         // TODO: Implement AutoDetect handling
  96                         if (config.CookieLess) {
  97                                 supportSessionIDReissue = true;
  98                                 return false;
  99                         } else {
 100                                 supportSessionIDReissue = false;
 101                                 return false;
 102                         }
 103                 }
 104
 105                 public void RemoveSessionID (HttpContext context)
 106                 {
 107                         context.Response.Cookies.Remove(config.CookieName);
 108                 }
 109
 110                 // TODO: add code to check whether the response has already been sent
 111                 public void SaveSessionID (HttpContext context, string id, out bool redirected, out bool cookieAdded)
 112                 {
 113                         if (!Validate (id))
 114                                 throw new HttpException ("Invalid session ID");
 115
 116                         HttpRequest request = context.Request;
 117                         if (!SessionStateModule.IsCookieLess (context, config)) {
 118                                 HttpCookie cookie = new HttpCookie (config.CookieName, id);
 119                                 cookie.Path = request.ApplicationPath;
 120                                 context.Response.AppendCookie (cookie);
 121                                 cookieAdded = true;
 122                                 redirected = false;
 123                         } else {
 124                                 request.SetHeader (SessionStateModule.HeaderName, id);
 125                                 cookieAdded = false;
 126                                 redirected = true;
 127                                 UriBuilder newUri = new UriBuilder (request.Url);
 128                                 newUri.Path = UrlUtils.InsertSessionId (id, request.FilePath);
 129                                 context.Response.Redirect (newUri.Uri.PathAndQuery, false);
 130                         }
 131                 }
 132
 133                 public virtual bool Validate (string id)
 134                 {
 135                         return true;
 136                 }
 137         }
 138 }
 139 #endif