?
Solved

Global.asa

Posted on 2006-04-05
43
Medium Priority
?
645 Views
Last Modified: 2008-02-01
I want to include a global.asa file that reset the sesion to "" if the user does not click on the logout button. I have been told that this can be achieved by a global.asa file. Before i start showing the code can i have some input.
0
Comment
Question by:lukegriffiths110
  • 22
  • 21
43 Comments
 
LVL 25

Accepted Solution

by:
kevp75 earned 2000 total points
ID: 16383254
you can do this with a global.asa file

you would use something similar to this

Sub Session_OnEnd
   session("sessionname") = ""
End Sub

now..there is a problem to this.   Problem is, if the user closes the window, goes to another page, or their computer freezes on them, session("sessionname") will not get set to "" unless the session timeout occurs.

Best bet is to use some kind of javascript to detect if the user has clicked the X, or hit ALT-F4, then use some autoclosing popup to set session("sessionname") = ""

Or.....you could lower you session timeout in your server.  Problem is with this is what if you have a user logged in to the site longer than your timeout.....

Personally, I wold nix the whole session variable idea, and just use cookies.  if you set no expiry on the cookie, it is only valid until that user closes the browser.  If security is an issue, set the cookie using some kind of encryption, and where you need to get the value from the cookie, decrypt it.

To set a cookie use:response.cookies("cookiename") = value
to get a cookie use:variable = request.cookies("cookiename")

HTAH
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16383258
here's a good point of reference for ya:
http://www.w3schools.com/asp/asp_cookies.asp
0
 

Author Comment

by:lukegriffiths110
ID: 16383435
I also have another question it relates to the one you answered before. If I restart the server and type in the url to search.asp, as the session = "" it redirects to login. If the user then logs in correctly and then clicks the logout link which runs this code:-

<%
Session.Abandon()
Session.Contents.RemoveAll()
response.redirect("adminlogin.asp")
%>

The user shouldn't then be able to view search.asp without logging in as i have printed the session to the screen in login and it is blank. However this isn't the case as the server some how is remembering the session and search can be viewed. Why is this and can this be prevented.
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 25

Expert Comment

by:kevp75
ID: 16384195
Session.Abandon()
Session.Contents.RemoveAll()

kills all session variables.  Only thing I can think of is a cookie.  Can you post the code for adminlogin.asp?
0
 

Author Comment

by:lukegriffiths110
ID: 16384285
Using the code below stops the cache another EE expert got it.

Response.CacheControl = "no-cache"
Response.AddHeader "Pragma", "no-cache"
Response.Expires = -1

However back to the global.asa file, i am finding it hard to sort . Basically all i need is for the session to be blanked if the user doesn't logout. The code below contains the functions i need but also extra coud you pull out the functions i need or explain each line.


<SCRIPT LANGUAGE=VBScript RUNAT=Server>


Sub Application_OnStart

Application("visits")
Application("Active") = 0


'      The connection string to the mdb.
Application("connString") = "Driver={Microsoft Access Driver (*.mdb)};Dbq=C:\Inetpub\wwwroot\online_Users\Online.mdb;Uid=Admin;Pwd=pass;"

End Sub



Sub Application_OnEnd
End Sub
Sub Session_OnStart


      
Session.Timeout = 20
Session("Start") = Now
Application.Lock
Application("visits") = Application("visits") + 1
intTotal_visitors = Application("visits")
Application.Unlock

Session("VisitorID") = intTotal_visitors
Application.Lock
Application("Active") = Application("Active") + 1
Application.Unlock
End Sub


Sub Session_OnEnd



set conn = Server.CreateObject ("ADODB.Connection")
      conn.Open Application("connString")
      
Dim update__MMColParam
update__MMColParam = "1"
if (Session("MM_Username") <> "") then update__MMColParam = Session("MM_Username")
      

      ' Update the record when the user logout and write the logout time
      ' plus it sets the user as OFFLINE.
      query = "UPDATE tblActiveusers SET LoggedOut=  now() , Online=1 "
      query = query & "WHERE Online=0 AND  Username= '" + Replace(update__MMColParam, "'", "''") + "'"
      
      conn.Execute (query)
      conn.Close
      set conn = Nothing


Application.Lock
Application("Active") = Application("Active") - 1
Application.Unlock

End Sub
</script>
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16384342
right in here:Sub Session_OnEnd



set conn = Server.CreateObject ("ADODB.Connection")
     conn.Open Application("connString")
     
Dim update__MMColParam
update__MMColParam = "1"
if (Session("MM_Username") <> "") then update__MMColParam = Session("MM_Username")
     

     ' Update the record when the user logout and write the logout time
     ' plus it sets the user as OFFLINE.
     query = "UPDATE tblActiveusers SET LoggedOut=  now() , Online=1 "
     query = query & "WHERE Online=0 AND  Username= '" + Replace(update__MMColParam, "'", "''") + "'"
     
     conn.Execute (query)
     conn.Close
     set conn = Nothing


Application.Lock
Application("Active") = Application("Active") - 1
Application.Unlock

End Sub

you can put session("sessionname") = "", however, please keep in mind what I posted earlier about what happens if a user just goes to another page, or their computer crashes, etc...

0
 

Author Comment

by:lukegriffiths110
ID: 16384395
Why does the script need to be conn to the database could this be removed, i have coppied this script from the net.
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16384430
in the Session_OnEnd.  Looks like it is there to update a table with the logged out time of the user.  It's your call to remove it or not, just keep in mind your application may be expecting a use for this, like some kind of report, or list of logged out users and the times they logged out at.

in the Application_OnStart section, the conn is set there so it can be readily available for all web applications on the server.  While this is not the route I would do it, it is not a bad idea.
0
 

Author Comment

by:lukegriffiths110
ID: 16384471
Would this work appart from the crashing.

<SCRIPT LANGUAGE=VBScript RUNAT=Server>

Sub Session_OnStart
Session.Timeout = 20
Session("Start") = Now
Application.Lock
Application("visits") = Application("visits") + 1
intTotal_visitors = Application("visits")
Application.Unlock

Session("VisitorID") = intTotal_visitors
Application.Lock
Application("Active") = Application("Active") + 1
Application.Unlock
End Sub

session("sessionname") = "",

</script>
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16384635
It would work, however, without:Application("connString") = "Driver={Microsoft Access Driver (*.mdb)};Dbq=C:\Inetpub\wwwroot\online_Users\Online.mdb;Uid=Admin;Pwd=pass;"
 in it you will have to go through every one of your files, and make sure to update every instance of Application("connString"), otherwise the whole application will fail.

Also:  You would need to do this

Sub Session_OnEnd
     session("sessionname") = ""
     Application.Lock
     Application("Active") = Application("Active") - 1
     Application.Unlock
End Sub

in order for that to work correctly, otherwise like it is is making session("sessionname") = "" all the time, which would is pointless to do, plus the Application("Active") would not be an accurate count with out it
0
 

Author Comment

by:lukegriffiths110
ID: 16385037
In search the code is now:-

<!--#include file="global.asa"-->



<%
'Check if user is logged in

Response.CacheControl = "no-cache"
Response.AddHeader "Pragma", "no-cache"
Response.Expires = -1



if Session("username") = "" then
     'If not, go to login page
     Response.Redirect("adminlogin.asp?error=2")
else
%>
<html>
<Head>
<link href="css/css.css" rel="stylesheet" type="text/css">
<style type="text/css">
<!--

div.test {
     width: 500px;
     height:300px;
     margin-bottom: 0px;
     margin-left: 10px;
     margin-right: 10px;

}
#auto {
     overflow: auto;
}

td {padding: 0px;}
-->
</STYLE>
</head>

<body bgcolor="#000000" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">

<body scroll="no" border="no" style="border-style: groove; border-width: 0">
<table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
  <tr>
    <td><table width="856" height="428" border="1" align="center" cellpadding="0" cellspacing="" bordercolor="#ffffff">
        <tr bordercolor="#FFFFFF">
          <td height="64" colspan="5" align="left" valign="top" bordercolor="#990000" bgcolor="#990000"><img src="images/CFLogo.jpg" width="330" height="50">
            <div align="center"></div></td>
          <td width="31" rowspan="2" valign="bottom" bordercolor="#990000" bgcolor="#990000">&nbsp;</td>
        </tr>
        <tr bordercolor="#FFFFFF">
          <td width="349" align="center" valign="middle" bordercolor="#990000" bgcolor="#990000"><img src="images/admin.jpg" width="250" height="188">
          </td>
          <td height="300" colspan="4" align="center" valign="top" bordercolor="#FFFFFF" bgcolor="#000000">
            <div align="center">
              <h1><%Response.Write(Session("username"))%></h1>
            </div><DIV CLASS="test" ID="auto">


<FORM id=FORM1 name=FORM1 action="list.asp" method=post>
<P>
  <TABLE cellSpacing=0 cellPadding=0 align=center bgColor=#000000 border=0>
    <TR align="center">
      <TD width="80"><font size=1 color=#ffffff>User Name</font></TD>
      <TD width="80"><FONT size=1 color=#ffffff>Logged in</FONT></TD>
      <TD width="80"><FONT size=1 color=#ffffff>IP Address</FONT></TD>
      <TD width="80"><FONT size=1 color=#ffffff>Sort</FONT></TD>
      <TD colspan="2">&nbsp;</TD>
    </TR>
    <TR align="center">
      <TD> <INPUT style="WIDTH: 60px" width="60" id=text1 name=text1></TD>
      <TD> <INPUT style="WIDTH: 60px" width="60" id=text2 name=text2></TD>
      <TD> <INPUT style="WIDTH: 60px" width="60" id=text4 name=text4></TD>
      <TD> <SELECT id=select1 name=Combo1>
          <OPTION value=>User Name</OPTION>
          <OPTION value=>Logged in</OPTION>
          <OPTION value=>IP</OPTION>
        </SELECT> </TD>
      <TD width="80"> <INPUT style="WIDTH: 60px; color:#ffffff; BACKGROUND-COLOR: #990000" type=submit value=Search width="60" name=button></TD>
      <TD width="80"> <INPUT style="WIDTH: 60px; color:#ffffff; BACKGROUND-COLOR: #990000" type=reset value=Clear width="60" name=button></TD>
    </TR>
  </TABLE>
  </P>
</FORM>



</tr>
        <tr bordercolor="#FFFFFF">
          <td height="20" colspan="6" align="right" bordercolor="#990000" bgcolor="#990000">
            <div align="right"><font color="#FFFFFF"><a href="logout.asp">Logout</a></font></div></td>
        </tr>
      </table></td>
  </tr>
</table>
</body>
</html>
<%
end if
%>


In global.asa. the code is:-

<SCRIPT LANGUAGE=VBScript RUNAT=Server>

Sub Session_OnStart      
      Session.Timeout = 1
      Session("Start") = Now
      Application.Lock
      Application("visits") = Application("visits") + 1
      intTotal_visitors = Application("visits")
      Application.Unlock
      Session("VisitorID") = intTotal_visitors
      Application.Lock
      Application("Active") = Application("Active") + 1
      Application.Unlock
End Sub


Sub Session_OnEnd
      session("sessionname") = ""
      Application.Lock
      Application("Active") = Application("Active") - 1
      Application.Unlock
End Sub


the error is:-

Script error detected at line 26.
Source line: <%
Description: Expected statement
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385104
you don't need to include global.asa in any file.

remove that line (<!--#include file="global.asa"-->) and see if the error comes up again

global.asa is a global file to the application.  as soon as someone requests a page on your site, global.asa executes, then the your page executes.
0
 

Author Comment

by:lukegriffiths110
ID: 16385129
The session is not being set back to "" what could be the problem
0
 

Author Comment

by:lukegriffiths110
ID: 16385144
Couldn't the code just be: -

Sub Session_OnStart    
     Session.Timeout = 1
     Session("Start") = Now
End Sub

Sub Session_OnEnd
     session("sessionname") = ""
End Sub

for what i need it to do
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385156
you will have to change session("sessionname") = "" to the session variable you wish to clear.

also:
Accepted Answer from kevp75
Date: 04/05/2006 09:21AM PDT
Grade: A
 Accepted Answer  


you can do this with a global.asa file

you would use something similar to this

Sub Session_OnEnd
   session("sessionname") = ""
End Sub

now..there is a problem to this.   Problem is, if the user closes the window, goes to another page, or their computer freezes on them, session("sessionname") will not get set to "" unless the session timeout occurs.

Best bet is to use some kind of javascript to detect if the user has clicked the X, or hit ALT-F4, then use some autoclosing popup to set session("sessionname") = ""

Or.....you could lower you session timeout in your server.  Problem is with this is what if you have a user logged in to the site longer than your timeout.....

Personally, I wold nix the whole session variable idea, and just use cookies.  if you set no expiry on the cookie, it is only valid until that user closes the browser.  If security is an issue, set the cookie using some kind of encryption, and where you need to get the value from the cookie, decrypt it.

To set a cookie use:response.cookies("cookiename") = value
to get a cookie use:variable = request.cookies("cookiename")

HTAH
0
 

Author Comment

by:lukegriffiths110
ID: 16385211
I have changed session name to user name but still nothing how do i know iif the global.asa file is running
0
 

Author Comment

by:lukegriffiths110
ID: 16385222
sorry but also could this code be used in the header instead of a global.asa. file
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385231
it could luke, but you also have to realize that you will need to make some serious changes to the application.

If I'm not mistaken you are building something to track your users?
in which case all that other stuff would have to stay, as it is what is going to be keeping count for you of who is logged in or out, and when they logged out and/or in.

Also, unless you change all your pages that reference Application("connString"), they will all fail, because this Application variable (your database connection string) is no longer being set where it needs to be.  Now, you can go and remove it, but as I said, you would need to go into every page that calls for it, and replace the Application("connString") with the actuall connection string for the database.
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385276
everytime a person browses to your site, that file is run.

Yes you could put some code in a header.asp file to do the work you need it to do, but you would have to code it differently than what you have.  but then you would have to go into every file and make sure it is included

do me a favor.put this in your page:
response.write("username") & "_" & Session("MM_Username")

and see what it puts out
0
 

Author Comment

by:lukegriffiths110
ID: 16385281
The application tracks students. However it is only the admin who i want to have security. The student tracking just logs the students login time, user name and IP. The admin then logs in on a different login and can view these details. This all works but the admin needs to be secure. This is were the problem is if the admin doesn't log out and the sesion is stored a student could view th details.
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385315
so then the rest of that code you removed will have to stay in global.asa, just like I said it would need to.

All that Application("Active") + 1 stuff is doing all the counting for you
0
 

Author Comment

by:lukegriffiths110
ID: 16385354
I don't need that tracked and it was removed from the database. It now only records the users ID, login time and IP I do not need to know who is online.
0
 

Author Comment

by:lukegriffiths110
ID: 16385376
The application works without the global.asa file.
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385387
ok, then take it out.
AS I SAID BEFORE:
without:Application("connString") = "Driver={Microsoft Access Driver (*.mdb)};Dbq=C:\Inetpub\wwwroot\online_Users\Online.mdb;Uid=Admin;Pwd=pass;"
 in it you will have to go through every one of your files, and make sure to update every instance of Application("connString"), otherwise the whole application will fail.


AND:
now..there is a problem to this.   Problem is, if the user closes the window, goes to another page, or their computer freezes on them, session("sessionname") will not get set to "" unless the session timeout occurs.

Best bet is to use some kind of javascript to detect if the user has clicked the X, or hit ALT-F4, then use some autoclosing popup to set session("sessionname") = ""

Or.....you could lower you session timeout in your server.  Problem is with this is what if you have a user logged in to the site longer than your timeout.....

Personally, I wold nix the whole session variable idea, and just use cookies.  if you set no expiry on the cookie, it is only valid until that user closes the browser.  If security is an issue, set the cookie using some kind of encryption, and where you need to get the value from the cookie, decrypt it.

To set a cookie use:response.cookies("cookiename") = value
to get a cookie use:variable = request.cookies("cookiename")
0
 

Author Comment

by:lukegriffiths110
ID: 16385413
Okay the cookie idea seems the best as security is not that important.
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385461
that's probably your best bet., just go and replace:
session("username") = usersname '(setting the session variable)

with:
response.cookies("username") = usersname  '(setting the cookie)

and where you would:
usersname = session("username")  '(requesting the session variable)

replace it with:
usersname = request.cookies("username")   '(requesting the cookie)
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385468
Q4U:  before you switch to cookies
0
 

Author Comment

by:lukegriffiths110
ID: 16385481
yes
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385488
I noticed in some code that there is: Session("MM_Username")

have you tried to replacing your session("username") with Session("MM_Username")???
0
 

Author Comment

by:lukegriffiths110
ID: 16385517
I could however when you logout the session returns "" the MM_userNAME I think is to do with dream weaver i will give it a go. but the cookies seems like a great alternative and easy to implement.
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385552
it is relatively easy.  I usually only use cookies, and if I need some added security on them, I use an encryption function
0
 

Author Comment

by:lukegriffiths110
ID: 16385567
I don't think i will but i'm not finding it that easy
0
 

Author Comment

by:lukegriffiths110
ID: 16385594
what is wrong here should it be<>

<%
if usersname = request.cookies("username")
     Response.Redirect("adminlogin.asp?error=2")
else
%>
<html>
<Head>
<link href="css/css.css" rel="stylesheet" type="text/css">
<style type="text/css">
<!--

div.test {
     width: 500px;
     height:300px
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385732
<%
if usersname = request.cookies("username")
     Response.Redirect("adminlogin.asp?error=2")
else
%>

should be

<%
if request.cookies("username") = ""
     Response.Redirect("adminlogin.asp?error=2")
else
%>
0
 

Author Comment

by:lukegriffiths110
ID: 16385826
For the logout what is the best way to clear the cookie, at the moment it clears session by:-

<%
Session.Abandon()
Session.Contents.RemoveAll()
response.redirect("adminlogin.asp")
%>
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385852
replace it with:

<%
request.cookies("username") = ""
response.rediret("adminlogin.asp")
%>
0
 

Author Comment

by:lukegriffiths110
ID: 16385914
I get this error:-

Script error detected at line 1.
Source line: request.cookies("username") = "" 
Description: Type mismatch: 'request.cookies'
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16385940
sorry bout that....should be response.cookies("username") = ""
0
 

Author Comment

by:lukegriffiths110
ID: 16385969
Last problem the cookie is being stored as when you logout you are able to click on the back button.
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16386048
you will have to add:

<%
Response.Expires = -1
%>

to each page.  what is happening there is the previous page is cached.  using this response.expires = -1 will prevent that page from being cached
0
 

Author Comment

by:lukegriffiths110
ID: 16386100
Okay i think everything is working now. Thanks for all your help you are truly an generous expert. I am going to leave full testing till 2moz as i will not go to sleep knowing something is not working. Thanks again luke
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16386120
:)

np
0
 
LVL 25

Expert Comment

by:kevp75
ID: 16388394
luke, there's someone I'm trying to help out here (http://www.experts-exchange.com/Web/Web_Languages/ASP/Q_21803432.html), and I'm wondering if I can let him know who you are to maybe discuss or help each other out with issues with Baby Web Server?
0

Featured Post

Prep for the ITIL® Foundation Certification Exam

December’s Course of the Month is now available! Enroll to learn ITIL® Foundation best practices for delivering IT services effectively and efficiently.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I recently decide that I needed a way to make my pages scream on the net.   While searching around how I can accomplish this I stumbled across a great article that stated "minimize the server requests." I got to thinking, hey, I use more than one…
I was asked about the differences between classic ASP and ASP.NET, so let me put them down here, for reference: Let's make the introductions... Classic ASP was launched by Microsoft in 1998 and dynamically generate web pages upon user interact…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
Look below the covers at a subform control , and the form that is inside it. Explore properties and see how easy it is to aggregate, get statistics, and synchronize results for your data. A Microsoft Access subform is used to show relevant calcul…
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question