1

I need to fire Session.Abandon() when a user leaves the page he is watching. If the user just refreshes the page session must be kept. I tried to do this client-side firing an ajax call when unloading the page window.addEventListener("unload", function(e)... but I'm not able to distinguish if the user is just refreshing the page or is leaving it. I'm currently usuing ASP.NET MVC5. Any suggestion, please?

Luca
  • 153
  • 10

1 Answers1

5

There is no straight-forward way to do this... The question is: why would you want to do this anyway? Feels like bad design to me.

You could handle some navigate event and check if the domain is the same as you currently have. If not, fire an AJAX call to abandon the session. Make sure to make that call a HTTP POST with a CSRF token to be sure not to be vulnerable to CSRF.

Community
  • 1
  • 1
Patrick Hofman
  • 153,850
  • 22
  • 249
  • 325
  • To answer your question: I need to keep in session a list of items that can be managed interating with the page (like a single page application). When the user clicks on "save" button data are persisted on DB. If you've a different approach to do this it will be very nice. – Luca Mar 08 '16 at 09:13
  • Okay. This answer could be helpful to you in that case. – Patrick Hofman Mar 08 '16 at 09:15
  • 1
    I tried to add a listener for the popstate event as explained in your link but seems not working on chrome. Can you post a working example that does what you suggested, please? – Luca Mar 08 '16 at 10:50