Session management with AxWebBrowser

[pgmanno]

Hello all,

Here is my question. I have an AxWebBrowser (hereafter refered to as
"Browser") control framed in a smart client. The smart client requires
logon, and the web app that the Browser is pointing to requires logon
and is using Forms Authentication. I have set up a web service so that
when the user logs on to the smart client, s/he can also log on to the
website (basically, the username/password is passed up, auth ticket set
and a session is established using cookies and the Browser uses those
cookies from that point forward).

My problem is that I want the Browser to be able to gracefully recover
from session expiration. Meaning, I do not EVER want to frame the
website logon page in the Browser, I always want it to be authenticated
from behind the scenes. The mechanism I used initially was creating my
own control that has an instance of a Browser, exposing a Navigate
method in that control which calls AxWebBrowser.Navigate2(), creating
another web service which returns a boolean indicating whether or not
the session is still alive, and on every call to Navigate, checking the
service and re-logging in if the session is not alive. That works just
fine as long as the Navigate method is called on my new control;
however, if the browser is visible, the session expires, and a link is
clicked, the code in the Navigate method is not called, and the Browser
redirects to the login page (since the session has expired). I though
about setting a windows hook to capture left click events and if the
browser is visible, go through the "check session" logic, but that
seems a bit like overkill. Anyone have any ideas how to handle this
issue?

Thanks,
pgm.

 

[Nicholas Paldino [.NET/C# MVP]]

pgm,

Instead of checking to see if the session is still alive, why not expose
a no-op on the service side which will keep the session alive? Then, behind
the scenes, your app can make calls to this no-op every few minutes or so
(some value before the session timeout).

This will also make it easier to program on the service side, since you
don't have to worry about the sessions being dropped, you can assume that it
is one continuous session.

Hope this helps.

 

[pgmanno]

Hi Nicholas,

Yeah, I thought of that, but it does not solve the problem of the web
app being restarted. I want it so that even if the app is redeployed,
the user will not be redirected to the login page.

 

[Nicholas Paldino [.NET/C# MVP]]

Hmm, why not create a cookie with a valid login which doesn't expire?
Then, have the website check for the cookie? This way, it will always be
passed to the website, and then you don't have to worry about app restarts.

 

[pgmanno]

Can't do that since multiple different people may use the same computer
at different times.