Unable to clear session completely

Question

I am working on an application in ASP.NET with c# and MSSQL DB. I am using a simple logic that if the session variables contain appropriate values then a page should open otherwise it should redirect to the login page. This is the code thats working.

protected void Page_Load(object sender, EventArgs e)
        {
            if(Session["loggedinloginid"]==null || Session["loggedinpassword"]==null)
                Response.Redirect("login.aspx");

            con.ConnectionString = ConfigurationManager.ConnectionStrings["familyConnectionString"].ConnectionString;
            con.Open();
            adp = new SqlDataAdapter("select * from admins where loginid=N'" + Session["loggedinloginid"].ToString() + "' AND password=N'" + Session["loggedinpassword"].ToString() + "'", con);
            dt = new DataTable();
            adp.Fill(dt);

            if (dt.Rows.Count == 0)
                Response.Redirect("login.aspx");

            LinkButton lb=(LinkButton)(Master.FindControl("LinkButton1"));
            lb.Text = "Welcome " + Session["loggedinloginid"].ToString()+"| Log Out |";
            lb.Click += new EventHandler(lb_Click);
        }

        void lb_Click(object sender, EventArgs e)
        {
            Session.Clear();
            Response.RedirectPermanent("WebForm2.aspx");
            //throw new NotImplementedException();
        }

The problem is that when I log out and clear the session and type the URL of the page in the browser that I want to protect (the page with this code), it opens! Why and how can I avoid this?

Did this page have some kind of cache ? on the browser, and this is the cached version that the browser brings ? — Aristos, Dec 29 '12 at 09:24
@Aristos: I don't think cache is causing this because it tried refreshing also and the page stays! I also tried Incognito in Chrome and Private Browsing in Mozilla Firefox. — Samarth Agarwal, Dec 29 '12 at 09:35

score 1 · Answer 1 · edited May 23 '17 at 11:48

1

  Session.Abandon();

Removes all the objects stored in a Session. If you do not call the Abandon method explicitly, the server removes these objects and destroys the session when the session times out.

View this link for difference between clear,abandon

What is the difference between Session.Abandon() and Session.Clear()

edited May 23 '17 at 11:48

Community

1
1

answered Dec 29 '12 at 09:33

sp_m

2,647
8
38
62

score 0 · Answer 2 · answered Dec 29 '12 at 09:24

0

you can use Session.Remove() method;

Session.Remove("session name");

answered Dec 29 '12 at 09:24

Prashant16

1,514
3
18
39

I did that already but that didn't help either. `Session.Clear()` is a more intense method. – Samarth Agarwal Dec 29 '12 at 09:36
have you try this Session["session name"] = null; – Prashant16 Dec 29 '12 at 12:09

score 0 · Accepted Answer · answered Dec 29 '12 at 10:45

0

you remove session after that page redirection completed to "WebForm2.aspx". you write the session remove function in that "Webform3.aspx" page. and after redirect to login page. and you check the webconfig file also.

answered Dec 29 '12 at 10:45

Rajamohan Anguchamy

1,726
1
17
35

that means to Redirect to logout.aspx Page, in that page do the Session remove Functionality like session.clear() or Session.Abandon() and after that u redirect to login.aspx page. – Rajamohan Anguchamy Jan 02 '13 at 08:27
Ok, i'll try and post back. – Samarth Agarwal Jan 05 '13 at 08:45

score 0 · Answer 4 · answered Jan 05 '13 at 09:58

Your problem is in this line:

   lb.Click += new EventHandler(lb_Click);

The code for the Click-EventHandler is never called, because you subscribe to the EventHandler in the OnLoad-Event, but that is too late in the lifecycle. Move the line into the OnInit-Event and your code should work as expected.

You should also think about sanatizing your SQL Queries to prevent SQL injections (I don't know how your login looks like, but based on the code you posted above, it might be vulnerable to SQL injections).

If .net 3.5 or higher is an option for you, I would suggest you have look at simple ORM-Mappers like Linq2SQl or EntityFramework (have a look at Linq2SQL first), which allow you to use LINQ for your queries and (afaik) sanatize your input.

If the code in this handler is not called, then why does the page get redirected? — Samarth Agarwal, Jan 05 '13 at 10:03

Unable to clear session completely

4 Answers4