ASP.NET session stateid issue

Question

i have a load balancing application, and we have an issue where a user try to log in, he/she will then see some else's name.

during the logout process we only call "Session.Abandon();". The article in http://support.microsoft.com/kb/899918 states the following:

When you abandon a session, the session ID cookie is not removed from the browser of the user. Therefore, as soon as the session has been abandoned, any new requests to the same application will use the same session ID but will have a new session state instance. At the same time, if the user opens another application within the same DNS domain, the user will not lose their session state after the Abandon method is called from one application.

does anyone have a clue of why the user sees some else's name while loging in?

Edited - code:

public class CacheManager
{
public Contact.Contact User
{
    get { return HttpContext.Current.Session["Contact"] as Contact.Contact; }
    set { HttpContext.Current.Session["Contact"] = value; }
}
}

header.ascx.cs

/// <summary>
/// This is the session manager
/// </summary>
public readonly CacheManager Localcache = new CacheManager();


public Login()
{
     var contact = BAL.Contact.Get(this.UserName, this.Password);
     Localcache.User = contact;
     Response.Redirect(Request.Url.AbsoluteUri);
}

protected void Logout_Click(object sender, ImageClickEventArgs e)
{
        Session.Abandon();
        Response.Redirect(Constants.HomePage);
}


header.ascx:

You are logged in as
<br />
<span class="user_desc">
<%= string.Format("{0} {1}",LocalCache.User.FirstName ,LocalCache.User.LastName)%></span>

Are you using InProc Session State mode? I think InProc does not work well with webfarm/network load balancing. Check this question stackoverflow.com/questions/7084729/… — pinoy_ISF

Rahul Rahul · Accepted Answer · 2013-07-08T07:17:44

when a user explicitly logs out and a new user accesses the page (assuming the browser wasn't closed), the browser still maintains the sessionId (even with Session.Clear() and Session.Abandon()).

Try to add these lines of code

Session.Abandon();
Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));

Link to check

ASP.NET session stateid issue

1 Answers