NEW Session Variable 1

[TMRO]

Hi everybody,

I have designed a shopping basket. The Order ID is stored in a session variable.

What I noticed is that if users right click on a link while they browse my application and choose "open link in a new window" the Order ID will stay the same in the new opened window.

So to say, they have 2 shopping sessions with the same Order ID.

Is that right? How can I prevent that?

The same is happening if I press Ctrl+N from the shopping basket.

Thank you,
TMRO

 

[Sheco]

The session is not the browser window...

...think of it as a timer that starts for each client when they access a resource. The timer counts down from X minutes to zero and then expires. If the client requests another resource the timer is reset to another X minutes.

 

[DotNetGnat]

Is that right? How can I prevent that?

YOU CANT

Session is maintained by the client by a cookie. How the client works with windows is up to them.

-DNG

 

[TMRO]

The session is not the browser window"

I would disagree, since if you start 2 IE sessions and enter in the same time in the shopping basket you have 2 Order ID's.

It looks like the right click "open link in new window" process is different then the double click on the IE icon from the desktop. (both of them will bring you in the application directly - the application is set up as a homepage)

Any explanations?

Thx

 

[DotNetGnat]

hmm...this is going to be interesting...after gleaning some
information online...here is the thing...

As i said earlier, Session is maintained by the client by a cookie. ASP Session state is maintained by round tripping a session identifier via a cookie. The browser needs to return this cookie to the server, and the server needs to validate that the contained session identifier is valid, and has not expired.

Since ASP's session cookies are "in memory" (non persistant) cookies, and processes do not share memory space, the new process could not access any of the in-memory cookies of the spawning process.

Opening new windows from within an existing instance of IE causes the windows to load within the same process.Using a desktop shortcut to IE, or a link of the Programs menu causes a new process to launch.

hope this helps...

-DNG

 

[DotNetGnat]

a link that also discusses this topic...

http://p2p.wrox.com/archive/security_asp/2001-11/1.asp

-DNG