Dynamic connString (now stored in session, bad)

Question

I working on a project where the connString is stored in a session variable. The problem is that the session runs out when the user is not around for a while (makes sense), thereby making the user having to log in again to create a new connection.

The user selects his database from a list of ODBC connection configured on the web server, therefore the different connStrings the user can chose from cannot be stored in the web.config as the user can add new ones as they wish.

I was wondering how to fix this problem. Should I just tell the user not to leave his computer for 20mins+ or can I perhaps store the connString someplace else? Ive seen websites making a pop-up saying "your session will expire in 5 mins, press ok to continue using the site", or something like that.

Furthermore it is not a possbility to make a static varible as the website is shared between many users, so if user1 choses "connString1" and user2 choses "connString2" afterwards, then user1 will unfortunatly be running on "connString2" aswell.

Hope you can help :)

**

Can this be a solution?: I create a "BasePage" which my pages inherit from. In this basepage i create a hiddenfield and add the connString to the value property on load. Furthermore I will encrypt the connString so the user cannot see the value in the source code. Then, if the session has a timeout, i will restore the session by using the value in the hiddenfield and the site will not crash.

score 0 · Answer 1 · edited May 23 '17 at 10:32

0

You could use the app.config to get and set config files. Take a look at this to see implementation of storing files. Its just as easy to get settings. ConfigurationManager doesn't save settings

//Edit: If you don't want the user to be able to see your connectionstring name then you can provice an another in hidden_html or cookie or session cookie. In this example I use a cookie. THis should solve your problem.

To set cookie:

HttpCookie myCookie = new HttpCookie("UserSettings");
myCookie["ConnectionString"] = "MyCOnnectionValue";
myCookie.Expires = DateTime.Now.AddDays(1d);//For one day.
Response.Cookies.Add(myCookie);//Will store the cookie within the users browser so your code can read from it at every request.

then:

if (Request.Cookies["UserSettings"] != null)
{
    string userSettings;
    if (Request.Cookies["UserSettings"]["ConString"] != null)
    { userSettings = Request.Cookies["UserSettings"]["ConString"]; }
}

string connectionStringNameToUse;

if(userSettings =="Connection1"){
    connectionStringNameToUse = "here you can have your name of connectionsstring";
}etc with ypur other connectionsstrings here. 

//Then use your connectionsstring here:
    using (SqlConnection cn = new SqlConnection(ConfigurationManager.ConnectionStrings[connectionStringNameToUse ].ToString()))
                {
                cn.Open();

                using (SqlCommand command = new SqlCommand
                    ("delete TBL from RatingListObjects TBL where ( TBL.TradeObject1Id = @MY_ID ) or ( TBL.TradeObject2Id = @My_ID ) ", cn))
                {
                    command.Parameters.Add(new SqlParameter("@MY_ID", customerToRemove.TradeObjectId));
                    command.ExecuteNonQuery();
                }
            }

On the other hand. I would go for saving the users database of choice in with the other user data in the db. But this is doable if you only want the user to have a chosen connectionsstring a certain time, set by the program. It wont allow them to see the connections string name. Hopes this helps, good luck!

edited May 23 '17 at 10:32

Community

1
1

answered Mar 16 '13 at 15:28

Magnus Karlsson

3,549
3
31
57

Im not sure I understand. This is ASP.net and i presume i only have a web.config here? If I try to add/edit something in the web.config while running, the entire site will reset and stop the other users from doing their work – Thomas Mar 16 '13 at 19:48
@Thomas If you dont have one you can add it. Heres an example in another question: http://stackoverflow.com/questions/5989736/accessing-app-config-in-asp-net – Magnus Karlsson Mar 16 '13 at 20:56
Thanks Magnus! Can you maybe look at at my "possible solution" in my edited post and say if it makes any sense at all – Thomas Mar 16 '13 at 21:14
@Thomas Well... one, imo, way to achieve this would be to use a cookie. Then you can save the chosen connection on the users computer as long as you want to without worrying whether the user is not at he/hers computer for a while. I mean, the ser dont actually use you conection string right? You could just store a value deciding which connection string to use. Or am I missing something? – Magnus Karlsson Mar 16 '13 at 21:33
Yes, true. Ive also thought about using a cookie. Difference is that I have to be 110% sure that the user has cookies enabled (which some users probably dont have for some weird reason). Its the easiest solution, but not sure it will work all the time – Thomas Mar 17 '13 at 07:18
@Thomas How many possible connectionstrings are there? Why do you need to encrypt the hiidden value? – Magnus Karlsson Mar 17 '13 at 09:36
Right now there are 20+ users using the same website (connecting to different databases on logon). The reason i wanted to encrypt the hiddenvalue is to ensure that the user cannot get any "funny ideas" by knowning such information. Its easy to encrypt so i thought "why noy" :) By using a cookie, the "experienced user" also has the possible to get information which he shouldnt know, but the most important part is that i cannot be sure that the user allows cookies – Thomas Mar 17 '13 at 15:17
Thanks for your help :) Ill go for the cookie solution if I can guarantee that the users will have to have cookies enabled. Again thanks for helping out – Thomas Mar 17 '13 at 21:07
@Thomas No problem, a little click on the "Answer" button would be nice though:) – Magnus Karlsson Mar 17 '13 at 21:11

score 0 · Answer 2 · answered Mar 16 '13 at 18:01

0

Can you store the user's connection string preference in their Profile and then persist their profile? http://odetocode.com/articles/440.aspx

You should also be able to do this for anonymous users.

As an aside, I don't know how secure the Profile APIs are, they should be fine, but just in case, you might want to store an Enum value and then map that to a Connection string in your code.

answered Mar 16 '13 at 18:01

Philip Pittle

11,821
8
59
123

Im guessing this requires me to have an extra database to store which database the user should be connecting to. I was hoping for another, more simple, solution, but i will look into it, thanks :) – Thomas Mar 16 '13 at 19:54

Dynamic connString (now stored in session, bad)

2 Answers2