Clearing Sessions - Browser Closing using close(cross mark at top right corner) butt

abinashpatra · January 9th, 2009, 02:27 AM

Hi,
I have SQL server Session Management and I have given time out as 20 in web config file.
I am creating some session objects to keep my datatables in a page. Now I have a situation where in user is closing the browser using cross button. Can I be sure that session will be cleaned up immediately? I guess no. Few questions in this regard are :
1. Is the session will end based on SQL Server Session setting?
2. Will the GC collect the session?
Could anybody please clarify me.

Lee Dumond · January 9th, 2009, 11:03 AM

Call Session.Abandon().

abinashpatra · January 10th, 2009, 12:37 AM

Dear Lee,
Problem for me is where to call this.
I can open up a small popup in the body unload and clear up all the session, but this will open up a tiny popup which I don't want. Is there any other way to do this?

Old Pedant · January 10th, 2009, 02:31 AM

Quote:

Originally Posted by abinashpatra

1. Is the session will end based on SQL Server Session setting?
2. Will the GC collect the session?

(1) Yes. At the time specified, 20 minutes after the last activity (if you use the default setting as you said you do).

(2) Yes, at the time that (1) occurs.

************

The problem with trying to do something using <BODY onUnload=> or <BODY onBeforeUnload=> is that you have to be VERY careful that your code is aware of when the unload is happening because the user closed the browser (or goes to another site or or or) instead of an unload that happens when you are moving to another page on your own site or even when your ASP.NET page is doing a POSTBACK. Yes, EACH change of page WILL invoke the UNLOAD. Yes, if you are very careful with your JavaScript code, you can figure out what kind of UNLOAD is happening. But it's not an easy task.

Unless this is really really important to you, I would suggest just letting .NET do the session close automatically, at the end of the 20 minutes.

Lee Dumond · January 10th, 2009, 02:43 AM

Usually, you would call this from a logout button. But, I see I did not read your question closely, as you were asking about what to do if the user closes the browser.

In that case, the session would remain alive to listen for requests until the time between requests exceeds the timeout value.

May I ask, why do you need to explicitly clear the session anyway?

If you are not storing sensitive information in Session, then it should not matter.

If you are storing sensitive information in Session, then you should be using SSL, to eliminate the possibility that the Sessiion could be hijacked.

abinashpatra · January 10th, 2009, 10:47 PM

Dear All,
Thanks for your responses.
To respond to Lee's Question,
1. Yes we are using the SSL. And there is no harm in waiting for the session to be cleared on its own.
2. I am interested in clearing the session because this will keep eating up the Server's memory(Web Server,IIS). We would be doing performance testing on this application and when load is applied and lets say session is not cleared then and there it would eat up the server memory to a greater extent.

Lee Dumond · January 10th, 2009, 11:30 PM

Thankfully, memory is not all that expensive nowadays.

Old Pedant · January 11th, 2009, 11:14 PM

> I am interested in clearing the session because this will keep eating up the Server's memory

Ummm... In your very first post, you said

Quote:

I have SQL server Session Management

So explain to me how you will eat up *MEMORY* when the session management is done in the *DATABASE*????

No, I do *not* think you will notice any memory being used.