First of all, thanks for your help on this. It's driving me nuts.
The simplest exampel is the IP address.
This function checks if it is the same IP, and if the sessionVariable is empty fills it.
private void CheckIPs()
{
if (Session[SessionVariables.IP.ToString()] != null)
{
if (Session[SessionVariables.IP.ToString()].ToString() != Request.ServerVariables["REMOTE_ADDR"])
{
string errorMessage = "The IP address in the session does not match the one in the request:" + Environment.NewLine +
"Session IP: " + Session[SessionVariables.IP.ToString()].ToString() + Environment.NewLine +
"Request IP: " + Request.ServerVariables["REMOTE_ADDR"] + Environment.NewLine;
Logger.Log("ERROR - " + errorMessage);
//clear out the session and send him back to the home page
Session.Abandon();
Session.Clear();
Response.Redirect("~/Default.aspx");
}
}
else
{
Session[SessionVariables.IP.ToString()] = Request.ServerVariables["REMOTE_ADDR"];
}
In this function is aclled from the OnInit method of the master page. It takes in the request object, session object, and a
logFileName and it logs some session details into a log specifed by the Request "REMOTE_ADDR".
public static void Log(System.Web.HttpRequest request, System.Web.SessionState.HttpSessionState session,
string filename)
{
using (StreamWriter sw = new StreamWriter(filename, true))
{
sw.WriteLine("==========" + DateTime.Now.ToString() + "===========");
sw.WriteLine("Session ID: " + session.SessionID);
sw.WriteLine("Request IP: " + request.ServerVariables["REMOTE_ADDR"]);
if (session[SessionVariables.IP.ToString()] != null)
{
sw.WriteLine("Session IP: " + session[SessionVariables.IP.ToString()].ToString());
}
sw.Flush();
sw.Close();
}
}
These are the only lines of code that touch the IP session variable, or the SessionID, both of which can be ocassionaly be fodn in logs with different request.ServerVariables["REMOTE_ADDR"].