Sessions in ASP

[rghthnrblmrc]

Hi. I am running ASP on a server, and some of my pages exist in one session, while others are in another session. Why are they not sharing a session? How can I make them share the same session? Thanks.

[so_is_this]

Sessions are controlled by the session id stored in the cookie sent to the client and returned by the browser with each HTTP request. You have no control over this cookie. The browser decides what cookies to send to the server based upon the associated domain name. If ASP has decided to create two different sessions then there is something about the configuration and/or presentation of your pages which is causing this result. Thus, the only way I know of for a separate session to be created is if the associated domain (or sub-domain) name has changed.

[rghthnrblmrc]

The sub-domain does not change. Many of the files are in a shared /bin/ directory, and some reside in other directories, which are not shared. Session.Timeout is set to 40. For some reason I have two sessions going on, each with it's own session id.

[russell]

2 sessions same browser instance? if so, close your browser (all browsers), clear cache and cookies. re-open.

this can happen if u have multiple browsers open.

[rghthnrblmrc]

No, that's not what is happening either... I have done that a million times... I am wondering something more from the sysadmin perspective. Is it possible that the shared /bin/ directory doesn't exist on the same server as the rest of the htdocs... I have never configured a server to do this before and I'm so unacquainted with Windows that I am not even sure if that configuration is possible.... That's the only thing I can think of, that the bin directory is actually on a physically different server.... If this is the case, then how do I configure them to share a session? Thanks.

[russell]

are you running IIS? it doesnt store sessions as files the way Apache does.

type this into the address bar of your browser:
javascript:alert(document.cookie);

how many cookies that start with aspsessionid ?

some of my pages exist in one session, while others are in another session
what does this mean? pages don't exist in a session, users do. what makes u think there are multiple sessions going on. how many session variables are u setting and how are u setting them?

[rghthnrblmrc]

Excuse my naiveness -

I don't believe I'm running Apache, since the 404 file-not-found page looks like Microsoft's. I do not have root access to the server, and the people who are administering it are entirely uncooperative with me, so i am just guessing.

I have 2 ASP session ID cookies, which is one reason I know that I have two sessions. Process of elimination has led me to believe that any pages inside the /bin/ directory (which is outside my document root) will fall within one session, and any pages in my document root fall into another session.

This is what I mean when I say that they belong to different sessions. The reason I say the "pages belong to the session" is because in my experiments, it seems to me that there is some kind of pair relationship between the server path and the user, rather than simply the server and the user, under whatever apparently bizarre configuration. Does that make any more sense?

Thanks for bearing with me.

[russell]

it is a hosted site? possible they may have load balancing messed up, though seems unlikely if they know what they are doing. question though -- how and why do u have pages outside of the web root? dont know how thats even possible. are these include files?

do u have 2 sites with same sub-domain? that would cause multiple session cookies -- for example site1.yourDomain.com and site2.yourDomain.com would produce 2 sessions. also, if u put entry in your own host file to alias a site (say for testing or for whatever reason) 2 sessions can happen. may be worth closing your browsers ( again ... :( ) and clear cookies, then navigate your site 1 page at a time, checking cookies every page hit. this may give u more clues as to whats going on. i keep a shortcut on my browser to javascript:alert(document.cookie) ( in my favorites / links in IE ) so i can see cookies with a click.

do u by chance hacve any pop-up windows of frames (including iframes) that host a different domain?

to find out what web server: create a web page to write out the value of Request.ServerVariables("SERVER_SOFTWARE")

[so_is_this]

Sounds to me like he's saying that pages at the following virtual url's produce two different sessions:

/page.asp

vs.

/bin/page.asp

[rghthnrblmrc]

Exactly...

* IIS/6.0-Microsoft is the server.
* /bin maps to a path outside my webroot; i cannot upload there; they will not host a script there for me.
* /bin is (stupidly) shared between all customers of this merchant "solution".
* i want to be able to pass my session variables into a script that lives in /bin

thanks.

[russell]

u can store the sessionid in a db, thgen pass that to /bin

[so_is_this]

* /bin maps to a path outside my webroot; i cannot upload there; they will not host a script there for me.
Oh, that is not what I thought you were saying. No wonder you are getting two different sessions.

Russel,

Does ASP have the ability to select the session (using the id) the way PHP does?

session_id($ord_id);
session_start();

[russell]

unfortunately no, but my assumption was that there is something other than an asp file in the /bin directory, in which case rghthnrblmrc should be able to pass in whatever he wants.

now u got me thinking that if it is an asp file, my solution obviously wont work. perhaps rghthnrblmrc can give more detail...?

i will say i still cant figure out how u could have asp files executed outside of wwwroot and still be in same domain -- except for server.execute() -- which executes in context of calling page...

[rghthnrblmrc]

There are a bunch of asp files in there. Unfortunately, i cannot write to the directory.
However, one way i've thought of dealing with the whole problem is just to "alias" the files in another directory outside of bin via a virtual include, and bypass the bin directory altogether. this should work, no? and may have saved me some time if i'd thought of it sooner.