2 // System.Web.Compilation.SessionStateItemCollection
5 // Marek Habersack (grendello@gmail.com)
7 // (C) 2006 Marek Habersack
11 // Permission is hereby granted, free of charge, to any person obtaining
12 // a copy of this software and associated documentation files (the
13 // "Software"), to deal in the Software without restriction, including
14 // without limitation the rights to use, copy, modify, merge, publish,
15 // distribute, sublicense, and/or sell copies of the Software, and to
16 // permit persons to whom the Software is furnished to do so, subject to
17 // the following conditions:
19 // The above copyright notice and this permission notice shall be
20 // included in all copies or substantial portions of the Software.
22 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
23 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
24 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
25 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
26 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
27 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
28 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
31 using System.Security.Cryptography;
33 using System.Web.Configuration;
34 using System.Web.Util;
36 namespace System.Web.SessionState
38 public class SessionIDManager : ISessionIDManager
40 static SessionStateSection config;
42 public SessionIDManager ()
46 public static int SessionIDMaxLength {
50 // Todo: find use for the context parameter?
51 public virtual string CreateSessionID (HttpContext context)
53 return SessionId.Create ();
56 public virtual string Decode (string id)
58 return HttpUtility.UrlDecode (id);
61 public virtual string Encode (string id)
63 return HttpUtility.UrlEncode (id);
66 public string GetSessionID (HttpContext context)
70 if (SessionStateModule.IsCookieLess (context)) {
71 string tmp = context.Request.Headers [SessionStateModule.HeaderName];
75 HttpCookie cookie = context.Request.Cookies [SessionStateModule.CookieName];
77 ret = Decode (cookie.Value);
80 if (ret != null && ret.Length > SessionIDMaxLength)
81 throw new HttpException ("The length of the session-identifier value retrieved from the HTTP request exceeds the SessionIDMaxLength value.");
83 throw new HttpException ("Invalid session ID");
88 public void Initialize ()
90 config = WebConfigurationManager.GetSection ("system.web/sessionState") as SessionStateSection;
93 public bool InitializeRequest (HttpContext context, bool suppressAutoDetectRedirect, out bool supportSessionIDReissue)
95 // TODO: Implement AutoDetect handling
96 if (config.CookieLess) {
97 supportSessionIDReissue = true;
100 supportSessionIDReissue = false;
105 public void RemoveSessionID (HttpContext context)
107 context.Response.Cookies.Remove(config.CookieName);
110 // TODO: add code to check whether the response has already been sent
111 public void SaveSessionID (HttpContext context, string id, out bool redirected, out bool cookieAdded)
114 throw new HttpException ("Invalid session ID");
116 if (!SessionStateModule.IsCookieLess (context)) {
117 HttpCookie cookie = new HttpCookie (config.CookieName, id);
118 cookie.Path = context.Request.ApplicationPath;
119 context.Response.AppendCookie (cookie);
123 context.Request.SetHeader (SessionStateModule.HeaderName, id);
126 string newUri = UrlUtils.InsertSessionId (id, context.Request.FilePath);
127 context.Response.Redirect (newUri, false);
131 public virtual bool Validate (string id)