How can I store session variables that can be accessed even after the browser is closed?

Posted on 2008-10-20
Last Modified: 2012-05-05
I'm using Session[""] variables right now but am having the problem of losing the data when the user closes the browser.  Because they will still be logged in, I need access to these variables once the browser is re-opened.

Do I store them as a cookie, and if so, how?
Question by:tektician
  • 3
  • 3

Accepted Solution

talker2004 earned 250 total points
Comment Utility
I would store it in a cookie, Although it is possilbe to latch back onto the session after the browser is closed, it is really note ment to work like that.

'Write to a cookie
        If Request.Cookies("UserGuid") Is Nothing Then
            Dim aCookie As New HttpCookie("UserGuid")
            aCookie.Value = UserGuid
            aCookie.Expires = DateTime.Now.AddDays(30)
            Response.Cookies.Item("UserGuid").Value = UserGuid
        End If

'read from the cookie

        If Not Request.Cookies("UserGuid") Is Nothing Then
            ActiveUserID = Request.Cookies("UserGuid").Value
        End If


Expert Comment

Comment Utility
You can take it a step further and use a cookieless session

in the web.config you can pass the session state key through the query string. After the user closes the browser it is possible to recreate the session. However your default setting on the server is 20 before the session expires.

In the system.web section of your web.config you can specify to pass the session state key as a query string.  

                        timeout="5" />

I want to warn you that your site could be session hijacked if somebody had the url in the users browser. I like it because i can copy the url from firefox to IE and transfer the session from one browser to another while i am in the middle of debugging my application.

Expert Comment

Comment Utility
Oh, and as far as the cookie example you can store the session state key in a cookie on the users computer to attempt to resume the session. Although I would not recommend leaving lots of sessions on your server, they could be inadvertently cleared because of numerous reasons unrelated to the session time out. App Pools are cleared on schedules as well as when the server memory usage for an application exceeds it's configured thresholds.

Once it's being passed through as a query string it is free game as to read in the string and store it into a cookie file.

If the user accidentally closed the browser then they would open it back up and you would read the url that you stored inside of the value in your cookie and redirect them to the uri which would go right back into the session.

BTW, The web.config solution is the only way to latch onto an existing session through an ASP.Net application. But there is ways to generate your own key to try to make it more secure. The concern is based off the theory that these things use random number generators and that hackers may be able to reproduce the same exact key at the same time as ASP.Net would. I don't think it's likely but there are solutions out there to do some type of unique encryption scheme.

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!


Author Comment

Comment Utility
Thanks for the reply talker,

could you please post the C# version to that code?  I haven't worked with VB before but I'll see if I can make that work with C#.

On another note, I want to make sure that the cookie is deleted if the user logs out using the LoginStatus control.  Is there a way to delete the cookie on the event of a logout through the LoginStatus control?

Author Comment

Comment Utility
I'm using cookies rather than session variables like you suggested and everything is working fine.

I also made sure that when the user logged out (using the LoginStatus control), I forced the existing cookies to expire:

HttpCookie cookie_userID = new HttpCookie("userID");
            cookie_userID.Expires = DateTime.Now.AddDays(-1d);


Author Closing Comment

Comment Utility
I put down the code in C# and it works fine, thanks!

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Log4Net custom Appender not being fired. 5 41
SignalR - getting new data from sql DB 5 63
DLL in ASP.NET 20 38
c# code 19 56
What is Node.js? Node.js is a server side scripting language much like PHP or ASP but is used to implement the complete package of HTTP webserver and application framework. The difference is that Node.js’s execution engine is asynchronous and event…
A publishing tool, a Version Control System, or a Collaboration Platform! These can be some of the defining words for the two very famous web-hosting Git repositories: Bitbucket and Github. Git is widely used amongst the programmers and developers f…
Use Wufoo, an online form creation tool, to make powerful forms. Learn how to selectively show certain fields based on user input using rules to gather relevant information and data from your forms. The rules feature provides you with an opportunity…
Learn how to set-up PayPal payment integration in your Wufoo form. Allow your users to remit payment through PayPal upon completion of your online form. This is helpful for collecting membership payments, customer payments, donations, and more.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now