|
|
February 17, 2010
The symptom
Users reported seeing data that did not belong to them when they logged into their accounts. Logs showed that nearly 10% of our users were being assigned copies of other users’ sessions. The entire session object was copied, including the sessionVariables and sessionID. Once duplicated the individual sessions could be modified without affecting the other (i.e. abandoning one did not kill the other).
To spot instances of the problem I stored the Request.RemoteHost (The IP address of the computer making the request) in a sessionVariable. At the beginning of each request I checked to make sure the session’s IP matched the current request’s IP.
What is was not
It is possible that the IP would change naturally, most simply if a user reset his router/modem. This was not the case because it was happening way too often. Further, there were confirmed instances of one user’s data being crossed with another’s. Finally, some of the pairs of IPs weren’t just on different computer, but were in different countries.
It is also possible, and was often suggested, that sessionVariables can stop being unique if they are used with static/shared variables within the WebApp. This was not the case either, because the IP address I stored in the session was only written to once, from the request and afterwards was only read to compare back to the request. This was also ruled out because the SessionID was also duplicated and that is a read only value.
What is was
It is a feature/bug in IIS7. This latest version of IIS introduced some new caching features.
- IIS7 automatically caches static content, such as HTML pages, images, and style sheets.
- IIS7 now has the ability to cache dynamic content as well.
Caching dynamic content is great if it is a page such as a dynamically generated image gallery, or a page that is generated dynamically based on the browser’s culture. However, in this thread, http://forums.iis.net/t/1154347.aspx?PageIndex=2, Anil Ruia, a Senior Software Design Engineer on the IIS Core, explains, “You should not be enabling output caching for any response which depends on session state.”
If the page generating the content depends on the session state, it caches the session object along with the rest of the page. The next user to come through ends up pulling the cached session, instead of getting a new one. When I checked our settings I found it was set to cache all .aspx pages for three minutes, including many pages that access the session.
The solution
In IIS7, disable the caching for .aspx pages in any directory with an asp.net page that depends on the session state. To do this:
- Run the Server Management console.
- Navigate to Roles -> Web Server (IIS) -> Internet Information Services.
- Select the site you wish to modify.
- Select the folder that contains the .aspx pages you need to turn caching off for.
- In the Feature View, double-click “Output Caching”.
- If there is a rule there already for the .aspx extension double click it. Otherwise right click and select “Add…”
- Enter .aspx for the “File name extension”
- Check “User-mode caching”
- Select “Prevent all caching”
- Check “Kernel-mode caching”
- Select “Prevent all caching”
- Click OK
- Close the Server management Console
September 10, 2009
Click Here to download the latest version of CalendarExtender Plus and documentation.
The CalendarExtender Plus is a modification of the calendar extender that ships as part of the Ajax Control Toolkit. There are two main features added to the control. First, you can limit the selectable dates to a specified date range. Second, there is now the option to show an alternate header. The new header includes two DropDown Lists, one to select the month and one to select the year.
(more…)
August 25, 2009
Scenario
Among the controls on a page is an update panel with a button that when clicked causes a partial postback that takes at least a few seconds. During this time you want to show the user a wait message that will disappear as soon as the postBack completes.
(more…)
August 12, 2009
Question
Under normal circumstances when a page loads with a tabContainer on it one tab must be selected. The selected tab can be specified via the ActiveTabIndex property. What if the tabContainer needs to default to an empty tab with none of the tabs selected?
Solution
Add a dummy tabPanel to the tabContainer and leave it blank. Use the pageLoad JavaScript function to hide the tab’s header
<cc1:TabContainer ID="TabContainer1" runat="server"
Height="200px" Width="200px" ActiveTabIndex="0">
<cc1:TabPanel runat="server" ID="tpDummy" HeaderText="">
<ContentTemplate>
</ContentTemplate>
</cc1:TabPanel>
<cc1:TabPanel runat="server" ID="tpName" HeaderText="Name">
<ContentTemplate>
Name:
<asp:TextBox runat="server" ID="txtName" />
</ContentTemplate>
</cc1:TabPanel>
<cc1:TabPanel runat="server" ID="tpEmail" HeaderText="Email">
<ContentTemplate>
Email:
<asp:TextBox runat="server" ID="txtEmail" />
</ContentTemplate>
</cc1:TabPanel>
</cc1:TabContainer> |
function pageLoad(sender, e)
{
var objTpDummy =
document.getElementById('<%= tpDummy.ClientID %>' + '_tab');
objTpDummy.style.display = 'none';
} |
August 10, 2009
Scenario
A page has a list of images for the user to choose from. When a file is selected the request is processed via an AJAX call that directs the source of an iFrame to another page where the image is generated and passed back to the client.
Due to the size of some of the images, the generation can take a noticeable amount of time. To make sure the user does not think the site is frozen a wait message is needed. Since the generating page only returns the image, we need another way to notify the client when the file is generated and the wait message can be hidden.
(more…)
June 16, 2009
|
Click Here to download the latest version of CalendarExtender Plus and documentation.
The CalendarExtender Plus is a modification of the calendar extender that ships as part of the Ajax Control Toolkit. There are two main features added to the control. First, you can limit the selectable dates to a specified date range. Second, there is now the option to show an alternate header. The new header includes two DropDown Lists, one to select the month and one to select the year.
|
The available dates can be limited using the MaxDate and MinDate properties.
<cc1:CalendarExtenderPlus runat="server" ID="cepExample"
TargetControlID="txtExample"
MaximumDate="01/01/2009" MinimumDate="5/15/2009 /> |
Setting the ShowDdlHeader to true will show the heading with dropDownLists to select the month and year.
<cc1:CalendarExtenderPlus runat="server" ID="cepHeaderExample"
TargetControlID="txtExample" ShowDdlHeader="true" /> |
The Calendar Extender Plus has a few other enhancements, including the ability to show or hide the arrows in the heading to move back and forth a month, and a property to show or hide today’s date at the bottom of the calendar.
Since the CalendarExtender Plus is a modification of the standard extender it has all the properties and functionality of the original. It can be skinned using the normal css, and automatically fills the textBox with no need for additional javascript.
The CalendarExtender Plus is free to download, use, and distribute with your project. Any feedback is greatly appreciated!
June 7, 2009
The Issue
The comboBox has a couple of server side events to deal with field changing.
- OnSelectedIndexChanged
- OnTextChanged
How can we catch the comboBox changing on the client side?
The Solution
Without access to these function on the client side, we need to use the client side events of the textBox that is contained within the comboBox. As with any textBox this one also has the onChange event, but the event does not run when the text was changed and the focus moved to another field. There are a few options:
- onKeyPress
- onKeyUp
- onBlur
The problem with onKeyPress is when it gets to the javascript function the value of the textBox is has not changed yet, leaving onKeyUp and onBlur. While onKeyUp will give the desired effect when the user presses a key on the keyboard, part of the point of a comboBox is the ability to use the mouse, which will not be captured by this event, leaving onBlur as the remaining option. It’s still not perfect, since the event won’t run until the focus is moved off the comboBox, but it appears to be the best option. In some cases you may want to use both onKeyUp and onBlur to get the best of both events, but be careful because when the user uses the keyboard and the moves the focus your event will run twice.
In the example below I have a comboBox named cmbExample and a javascript function that accepts the textBox calling it as a parameter, cmbExample_OnBlur(textBox). I add the onBlur event to the textBox in the Page_Load method in the code behind.
protected void Page_Load(object sender, EventArgs e)
{
TextBox textBox = cmbExample.FindControl("TextBox") as TextBox;
if (textBox != null)
{
textBox.Attributes.Add("onBlur", "cmbExample_OnBlur(this);");
}
} |
June 3, 2009
The Control
Microsoft recently released version 3.0.30512 of the AjaxControlTookit, available here. One of the new controls is the ComboBox, which “provides a DropDownList of items, combined with TextBox.”
The Issue
Placing the ComboBox in a container that has the style attribute “display: none;” throws the error “Invalid argument.” This is true if the container is a panel with the attribute set explicitly, or a different container such as a TabPanel that implicitly has the display attribute set to none when it is not shown.
(more…)
May 14, 2009
April 1, 2009
Scenario
A page has multiple validation groups:
The submit button on the page is a member of vgMain, so automatically it will only run the validation on that group. A solution is needed that will run validation on multiple groups and block the postback if needed.
(more…)
Older Posts »
|
