ASP.NET MVC 3 determine session status (new or timeout)

Question

I currently use the default forms authentication method for my ASP.NET MVC application.

above all of my actionmethods that require authentication I have this attribute

[Authorize()]

When someone tries to call the page that that action method "serves" and they haven't yet logged in, it sends them to the login page...perfect! However, if their session times out and they try to hit that page, they're also just redirected to the login page with no indication of why. I'd like to be able to determine if it's a new visit, or if it's a timeout and display a different message on the login screen accordingly.

Is that possible?

Sam · Accepted Answer · 2011-11-21 22:04:48Z

Have a look at this custom authorize attribute i have made. It was to implement some custom role based authorization, but you could make it work for you as well. There is a Session.IsNewSession property you can check to see if this request takes place on a new session.

public class CustomAuthorizeAttribute : AuthorizeAttribute
    {
        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            if (httpContext.User.Identity.IsAuthenticated)
            {
                httpContext.User = new GenericPrincipal(httpContext.User.Identity, AdminUserViewModel.Current.SecurityGroups.Select(x => x.Name).ToArray());
            }
            return base.AuthorizeCore(httpContext);
        }

        protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
        {
            if (filterContext.HttpContext.User.Identity.IsAuthenticated)
            {
                filterContext.Result = new RedirectResult("/Authentication/NotAuthorized", false);
            }
            else
            {
                if (filterContext.HttpContext.Session.IsNewSession)
                {
                    // Do Something For A New Session
                }
                base.HandleUnauthorizedRequest(filterContext);
            }
        }
    }

Garrett Vlieger · Accepted Answer · 2011-11-21 21:55:58Z

0

On sign-in, you can set a cookie that's tied to the browser session. If that cookie exists, you know that the session timed out. If not, you know it's a new visit.

answered Nov 21, 2011 at 21:55

Garrett Vlieger

9,4995 gold badges35 silver badges45 bronze badges

Collectives™ on Stack Overflow

ASP.NET MVC 3 determine session status (new or timeout)

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related