Enabling multi tab support will log out active users

[Matthew51]

When I enable this users that are actively using my site get logged out regularly.  They tell me it happens about every 30 min which is what my session time out is set to.  If I disable multi-tab support again without making any other changes the problem goes away.

I have also noticed that new tabs don't inherit the session data of the original tab.  I don't know if these are related, but this one is defiantly the smaller of the two issues.

NetTalk 8.71

Thanks
Matthew

[Bruce]

Hi Matthew,

>> I have also noticed that new tabs don't inherit the session data of the original tab.

that's the whole point of multi-tab support. Each tab is effectively a separate "sub session". So the fact that they don't inherit is "by design".

>> When I enable this users that are actively using my site get logged out regularly.  They tell me it happens about every 30 min which is what my session time out is set to.  If I disable multi-tab support again without making any other changes the problem goes away

Are you using the count-down timer so the user can see the time left on the session? If you are, and the time out takes them to a page (maybe the login page?) which does a LogOut then you would get the effect you are seeing. There's a collection of "rules" in places here.

1. When using multiple tabs then if you log in (or out) on any tab, you are logging in (or out) on all of them.
2. Any activity on any tab will extend all the tabs (But WON'T affect the count-down timer.)
3. The count-down timer triggers an automatic URL. (Which means if that URL logs them out, then they are logged out.)

In a multi-tab situation I would remove the Timer (typically it's in the footer procedure.) That should sort things out.

cheers
Bruce

[Matthew51]

It has nothing to do with a countdown timer, and after a whole day of digging deep into net talk code I think I found the problem and a solution.  In my testing I noticed that every new page request created a new session, and that every new session had the same sessionID as the original session.

This was because _FindSessionID was creating new sessions, because _ParseSettings was returning 0.
Turning on your traces gave me:

Code: [Select]

[2308] [st] [netTalk][thread=3] PARSESETTINGS 0 pStart=420 pEnd=670 __RequestVerificationToken=tIZewJKJu8rQ79xMBoFc4fDtVYc9iVRaeHSiRCl7-Nixx0xG2-Dxp59wc7RT1FHyutVlQ-TmeWIQ8U4NrbEJ6JgoW0PC5XEu1qPJHVQyCEAWhWR2fyIcX4THkfAtgH1Nl6SNakpbnC8_Hcxt0AC0LQ2; SESSIONID=Inv91ppX89pXEUZGT0cCNqw3fXWP85; x-TabID=feamcabtu4436gqilik9
[2308] [st] [netTalk][thread=3] PARSESETTINGS LOOP pStart=420 pEnd=669 __RequestVerificationToken=tIZewJKJu8rQ79xMBoFc4fDtVYc9iVRaeHSiRCl7-Nixx0xG2-Dxp59wc7RT1FHyutVlQ-TmeWIQ8U4NrbEJ6JgoW0PC5XEu1qPJHVQyCEAWhWR2fyIcX4THkfAtgH1Nl6SNakpbnC8_Hcxt0AC0LQ2; SESSIONID=Inv91ppX89pXEUZGT0cCNqw3fXWP85; x-TabID=feamcabtu4436gqilik9 SEP=; x=179 p_Encoded=0
[2308] [st] [netTalk][thread=3] PARSESETTINGS LOOP pStart=599 pEnd=669  SESSIONID=Inv91ppX89pXEUZGT0cCNqw3fXWP85; x-TabID=feamcabtu4436gqilik9 SEP=; x=42 p_Encoded=0
[2308] [st] [netTalk][thread=3] PARSESETTINGS LOOP pStart=641 pEnd=669  x-TabID=feamcabtu4436gqilik9 SEP=; x=0 p_Encoded=0

The key here is that _AddSetting handled "x-TabID" after "SESSIONID" as it only return 1 on sessions ids.  I changed the loop in _ParseSettings to:

Code: [Select]

  loop while p_end >= p_start
    x = instring (clip(sep),p_settings[p_start : p_end],1,1)
    self._trace('PARSESETTINGS LOOP pStart=' & p_Start & ' pEnd=' & p_End & ' ' & clip(p_settings[p_start : p_end]) & ' SEP=' & clip(sep) & ' x=' & x & ' p_Encoded=' & p_Encoded)
    if x = 0
      if p_Encoded = Net:Inline
        done = self._AddSetting(p_settings[p_Start : p_End],p_OnlySessionID,p_Plus)
      else
        done = self._ParsePart(p_settings,p_Start,p_End,p_OnlySessionID)
      end
      if p_OnlySessionID AND (Self.BrowserTabId and Self.SessionID)
        done = 1
      end
      break
    else
      if p_Encoded = Net:Inline
        done = self._AddSetting(p_settings [p_start : p_start-1+x-1],p_OnlySessionID,p_Plus)
      else
        done = self._ParsePart(p_settings,p_start,p_start-1+x-1,p_OnlySessionID)
      end
      p_start += x+y-1
    end
    !if done then break. !! removed in 8.67. Need to parse out SessionID and possible TabId
    If p_OnlySessionID
      If IsTabId = 0
        If done then break.
      Else
        if Self.BrowserTabId and Self.SessionID
          done = 1
          BREAK
        END
      End
    End
  end
Now everything is working exactly as I expect it to.  However this is by far the deepest I've gone into NetTalk code so if you could have a look at it.  Also these changes won't survive next time I update net talk, so a more permanent solution is needed.

Thanks
Matthew

[Matthew51]

I thought about this some more and I think it would be better to put

Code: [Select]

IF Self.SessionID THEN dome = 1 ENDright before the return.  The reason being is that I think this function should return 1 whenever the SessionID is found, regardless of anything else.  Otherwise _FindSessionID will end up creating a new session with the same ID, and bad things will happen.  Though at this point the done variable is not living up to its name very well.

EDIT: It may also be useful to differentiate between just the SessionID being found and both SessionID and x-tabid.

[Bruce]

Hi Matthew,

I think the best way forward is to post an example app which shows the effect you have discovered. ie using an unaltered netweb.clw, but perhaps with a trace in NewSession or FindSession or wherever to show what you are seeing.

Then I can follow that to see where it goes. I can then also try your proposed changes to see the effect that that has.

I need to be careful with this one because obviously any issues here could have rather large knock-on effects.

thanks.

Cheers
Bruce

[Matthew51]

The only changes I've made to the example was to turn on multitab, and set the session time out to 1 min.  The problem seems to show up right way in chrome, but you need to open a second tob in IE 11 before it starts creating new sessions.  The key is that the program will make a new session every time "x-TabID" is after "SESSIONID" in the cookie.

I've also included my NetWeb.clw for reference.  It has my additions commented out.

[Bruce]

Thanks Matthew,
I've tweaked it for the 9.10 build.

cheers
Bruce