How do I know which user's session id has been expired (and which users are online?)

问题

I am developing an online chess game. After a user presses the login button, I save userid in a session variable:

     Session["userID"] = userId.Text;

After assigning the variable, the user is transferred to another page.

There is a possibility more then one user is online at a time. Let say three user are online at a time and in session variable one user contain "1" userId, next contain "2" and so on.

If one of the user's Session Id expires for some reason, how do I know which user's session expired?

The reason is I want to show the other users that this particular user is not online anymore.

回答1:

Session data is meant to be private to the user and is not meant to be accessible to the rest of your application (that is, outside the user's context). That means that doing what you want using the session is going to be hard and awkward.

A better alternative would be to track user activity in a separate datastructure and keep that in the web server's memory (using a static variable or the System.Web.Caching namespace) or in the database.

回答2:

For every user you can save session information in remote storage (database for example) with expiration date (that must be MORE than the session expiration date from application configuration) and userID binding and after user is making some action in your application you can change the expiration date by adding some value. So that in this case you always have the list of not expired sessions, controled by you.
With Session variable - you can see session information just about the current request from the client. So that using just this variable you sure can't see other users' sessions, that would be just unsecure.

回答3:

How do I know which user session variable expired?

You can subscribe to the SessionStateModule.End event:

  public class KyuApplication : System.Web.HttpApplication
  {
    public override void Init()
    {
        SessionStateModule session = Modules["Session"] as SessionStateModule;
        if (session != null)
        {
            session.Start += new EventHandler(Session_Start);
            session.End += new EventHandler(Session_End);
        }
    }

    private void Session_Start(object sender, EventArgs e)
    {
        System.Diagnostics.Debug.WriteLine("Session_Start");
    }

    private void Session_End(object sender, EventArgs e)
    {
        System.Diagnostics.Debug.WriteLine("Session_End");
    }
}

Example from: http://johnllao.wordpress.com/2009/06/05/session_start-and-session_end-event-from-custom-httpapplication/

The reason is I want to show the other users that this particular user is not online anymore.

You approach is unnecessary. The Asp.Net membership framework provides this functionality for you so you don't have to build it yourself. You can use MembershipUser.IsOnline to do this for you.

Example from MSDN:

  MembershipUserCollection users;

  public void Page_Load()
  {
     users = Membership.GetAllUsers();

     if (!IsPostBack)
     {
        // Bind users to ListBox.
        UsersListBox.DataSource = users;
        UsersListBox.DataBind();
     }


     // If a user is selected, show the properties for the selected user.

     if (UsersListBox.SelectedItem != null)
     {
          MembershipUser u = users[UsersListBox.SelectedItem.Value];

          EmailLabel.Text = u.Email;
          IsOnlineLabel.Text = u.IsOnline.ToString();
          LastLoginDateLabel.Text = u.LastLoginDate.ToString();
          CreationDateLabel.Text = u.CreationDate.ToString();
          LastActivityDateLabel.Text = u.LastActivityDate.ToString();
     }
 }

Here are some additional blog posts that discuss this in more detail and describe how to set it up:

http://dotnetslackers.com/articles/aspnet/tracking-user-activity.aspx
http://blog.dreamlabsolutions.com/post/2009/07/13/ASPNET-Membership-Show-list-of-users-online.aspx

回答4:

You can use the SessionStateModule.End Event to catch that.

来源：https://stackoverflow.com/questions/25114639/how-do-i-know-which-users-session-id-has-been-expired-and-which-users-are-onli

标签

ASP.NET

session-variables