Member Avatar for selman555

Hi all,

I have question about sessions in web services (VB).
I created a function that allows me to login to my web service. I created a session here and added some values I retrieved from a stored procedure.

The code will explain more :)

<WebMethod(EnableSession:=True)> _
    Public Function GebruikerLoginWeb(ByVal strGebr As String, ByVal strWachtw As String) As Boolean
        Try
            Dim fm As New Methods_Functions()
            Dim dsLBPHL As DataSet
            dsLBPHL = fm.GebruikerLogin(strGebr, strWachtw)
            If dsLBPHL.Tables.Count > 0 Then
                boolStatus = True
                Session("Gebruikersnaam") = dsLBPHL.Tables(0).Rows(0)(0).ToString
                dsTemp = fm.GebruikerSelecteerAlle(Session("Gebruikersnaam").ToString)
                Session("Wachtwoord") = dsTemp.Tables(0).Rows(0)(1).ToString
                Session("Voornaam") = dsTemp.Tables(0).Rows(0)(2).ToString
                Session("Achternaam") = dsTemp.Tables(0).Rows(0)(3).ToString
                Session("Adres") = dsTemp.Tables(0).Rows(0)(4).ToString
                Session("Gemeente") = dsTemp.Tables(0).Rows(0)(5).ToString
                Session("Email") = dsTemp.Tables(0).Rows(0)(6).ToString
                Session("Geactiveerd") = dsTemp.Tables(0).Rows(0)(7).ToString
                Session("Admin") = dsTemp.Tables(0).Rows(0)(8).ToString
            Else
                boolStatus = False
            End If
            Return boolStatus
        Catch ex As Exception
            objLoggingService.WriteLine(strAppName, ex.Message)
            Throw (ex)
        End Try
    End Function

As you can see, I filled the session with values.
My question is: I have a default.aspx and a master page, how can I redirect the user when their session is active? For example, the default page tells users that access is forbidden untill the login/register.

Do I have to use the form load handler for default.aspx or the masterpages' load handler? How do I check weither the usersession is active?

  • 2 Contributors
  • 1 Reply
  • 293 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by thines01

Dani AI

Generated

When a WebMethod runs with EnableSession:=True (as in ’s login method) the session values written there are available to ASP.NET pages — provided the browser sends the same session cookie on subsequent requests. For site-wide access control, centralize the check: put a simple existence check in the MasterPage (or better, in a shared base Page class that all pages inherit). For single-page rules use that page’s Page_Load. The check should test the session key for null/empty rather than rely on Server-side exceptions.

Example (MasterPage/Page_Load):

Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs) Handles Me.Load
    Dim usr As String = TryCast(Session("Gebruikersnaam"), String)
    If String.IsNullOrEmpty(usr) Then
        Response.Redirect("~/Login.aspx")
    End If
End Sub

Example (Login page — redirect when already authenticated):

Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs) Handles Me.Load
    If Not IsPostBack Then
        Dim usr As String = TryCast(Session("Gebruikersnaam"), String)
        If Not String.IsNullOrEmpty(usr) Then
            Response.Redirect("~/Default.aspx")
        End If
    End If
End Sub

Practical notes and cautions:

  • If the login call is via AJAX, the browser must send the session cookie. For cross-origin calls enable credentials (jQuery: xhrFields: { withCredentials: true }; fetch: credentials: 'include') and allow credentials on the server. Inspect the Set-Cookie and Cookie headers in dev tools to confirm the same ASP.NET_SessionId is returned and resent.
  • Do not store plaintext passwords in Session; store a user id and minimal claims/roles and use Forms Authentication or token-based auth for APIs.
  • For production/scaled apps, use out-of-process session state (StateServer/SQL/Distributed cache) or switch to stateless tokens to avoid session affinity issues.

As suggested, showing the final redirect approach (master/base page + defensive session checks) helps others reproduce and debug the behavior.

Member Avatar for thines01

Can you show/tell your solution so others can see it?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.