I keep getting an error in the event log when a user logs out in the session_end. The specific error code is:

Exception type: NullReferenceException
Exception message: Object reference not set to an instance of an object.

The referenced lines starts this sequence. Anybody help me out? Many thanks.

If System.Web.HttpContext.Current.User IsNot Nothing Then
 If HttpContext.Current.User.Identity.IsAuthenticated Then
 System.Web.Security.FormsAuthentication.SignOut()
 System.Web.HttpContext.Current.User = Nothing
  End If
 End If
Session.Abandon()
Session.Timeout = 0
Response.Cookies.Clear()
Response.Redirect("calendar/default.aspx")

The session end event in the global does not fire on a request context. Consider that if a user is making a request, then their session cannot be ending. So basically, you can not execute any code that will doing anything with HttpContext or Request/Response. You can only work with the information of the session that is ending.

It appears that you are attempting to "push" the client back to a page when their session ends. You can't do that from the server. You need to use client-side code to handle a session timeout scenario.

-Peter
peterlanoie.blog

Peter,

Thank you for your reply. So, if I'm using forms authentication, and a person clicks a button to "log out", how would one handle that in client-side vs. server-side code? Do you have a link to an example?

Thanks so much,
Janet

Well, that's a bit of a different story.

If a user is explicitly logging out, then just do what you need during the code that logs them out. There isn't any need to put code in the session_end handler. (I am not even convinced that that method runs when a user logs out. Yes, they are logging out, but their session persists.)

Usually you would use session_end to execute cleanup code when a user session that ends after a period of user inactivity.

-Peter
peterlanoie.blog

Peter,
Thanks soooo much for your explanation. It clears things up considerably. I think I was going nuts at the time to prevent a back-button return to a page after logout - much of this stuff was trying everything at that point to get something to work.

Removed the code from session_end and everything works lovely. (Even the back-button non-return, which was really probably handled by the System.Web.Security.FormsAuthentication.SignOut() and no-cache paramters and had nothing to do with this.)

Really appreciate your time...