How can I store session variables that can be accessed even after the browser is closed?

Posted on 2008-10-20
Medium Priority
Last Modified: 2012-05-05
I'm using Session[""] variables right now but am having the problem of losing the data when the user closes the browser.  Because they will still be logged in, I need access to these variables once the browser is re-opened.

Do I store them as a cookie, and if so, how?
Question by:tektician
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3

Accepted Solution

talker2004 earned 1000 total points
ID: 22763899
I would store it in a cookie, Although it is possilbe to latch back onto the session after the browser is closed, it is really note ment to work like that.

'Write to a cookie
        If Request.Cookies("UserGuid") Is Nothing Then
            Dim aCookie As New HttpCookie("UserGuid")
            aCookie.Value = UserGuid
            aCookie.Expires = DateTime.Now.AddDays(30)
            Response.Cookies.Item("UserGuid").Value = UserGuid
        End If

'read from the cookie

        If Not Request.Cookies("UserGuid") Is Nothing Then
            ActiveUserID = Request.Cookies("UserGuid").Value
        End If


Expert Comment

ID: 22764007
You can take it a step further and use a cookieless session

in the web.config you can pass the session state key through the query string. After the user closes the browser it is possible to recreate the session. However your default setting on the server is 20 before the session expires.

In the system.web section of your web.config you can specify to pass the session state key as a query string.  

                        timeout="5" />

I want to warn you that your site could be session hijacked if somebody had the url in the users browser. I like it because i can copy the url from firefox to IE and transfer the session from one browser to another while i am in the middle of debugging my application.

Expert Comment

ID: 22764077
Oh, and as far as the cookie example you can store the session state key in a cookie on the users computer to attempt to resume the session. Although I would not recommend leaving lots of sessions on your server, they could be inadvertently cleared because of numerous reasons unrelated to the session time out. App Pools are cleared on schedules as well as when the server memory usage for an application exceeds it's configured thresholds.

Once it's being passed through as a query string it is free game as to read in the string and store it into a cookie file.

If the user accidentally closed the browser then they would open it back up and you would read the url that you stored inside of the value in your cookie and redirect them to the uri which would go right back into the session.

BTW, The web.config solution is the only way to latch onto an existing session through an ASP.Net application. But there is ways to generate your own key to try to make it more secure. The concern is based off the theory that these things use random number generators and that hackers may be able to reproduce the same exact key at the same time as ASP.Net would. I don't think it's likely but there are solutions out there to do some type of unique encryption scheme.

Percona Live Europe 2017 | Sep 25 - 27, 2017

The Percona Live Open Source Database Conference Europe 2017 is the premier event for the diverse and active European open source database community, as well as businesses that develop and use open source database software.


Author Comment

ID: 22764096
Thanks for the reply talker,

could you please post the C# version to that code?  I haven't worked with VB before but I'll see if I can make that work with C#.

On another note, I want to make sure that the cookie is deleted if the user logs out using the LoginStatus control.  Is there a way to delete the cookie on the event of a logout through the LoginStatus control?

Author Comment

ID: 22764728
I'm using cookies rather than session variables like you suggested and everything is working fine.

I also made sure that when the user logged out (using the LoginStatus control), I forced the existing cookies to expire:

HttpCookie cookie_userID = new HttpCookie("userID");
            cookie_userID.Expires = DateTime.Now.AddDays(-1d);


Author Closing Comment

ID: 31508110
I put down the code in C# and it works fine, thanks!

Featured Post

Video: Liquid Web Managed WordPress Comparisons

If you run run a WordPress, you understand the potential headaches you may face when updating your plugins and themes. Do you choose to update on the fly and risk taking down your site; or do you set up a staging, keep it in sync with your live site and use that to test updates?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

It was really hard time for me to get the understanding of Delegates in C#. I went through many websites and articles but I found them very clumsy. After going through those sites, I noted down the points in a easy way so here I am sharing that unde…
The article shows the basic steps of integrating an HTML theme template into an ASP.NET MVC project
Use Wufoo, an online form creation tool, to make powerful forms. Learn how to selectively show certain fields based on user input using rules to gather relevant information and data from your forms. The rules feature provides you with an opportunity…
Learn how to set-up PayPal payment integration in your Wufoo form. Allow your users to remit payment through PayPal upon completion of your online form. This is helpful for collecting membership payments, customer payments, donations, and more.

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question