à˵Øã´ áÅÐÍÂèÒ§äÃà«ÊªÑ¹ä´éà¢éÒÃËÑÊà»ç¹ reused ã¹ ASP.NET

º·¤ÇÒÁ¹Õé͸ԺÒÂÇÔ¸Õ¡Òà áÅÐà˵Øã´ÃËÑÊà«ÊªÑ¹ ASP.NET ·Õè Microsoft ãªé

ʶҹТͧà«ÊªÑ¹ ASP.NET à»ç¹à·¤â¹âÅÂÕ·ÕèªèÇÂãËé¤Ø³à¡çº¢éÍÁÙÅ ½Ñè§à«ÔÃì¿àÇÍÃì ੾ÒТͧ¼Ùéãªé â»Ãá¡ÃÁ»ÃÐÂØ¡µìàÇçºÊÒÁÒöãªé¢éÍÁÙŹÕéà¾×èÍ»ÃÐÁÇżšÒÃÃéͧ¢Í¨Ò¡¼Ùéãªé«Öè§ instantiated ʶҹÐà«ÊªÑ¹ ¼ÙéãªéʶҹÐà«ÊªÑ¹¶Ù¡¡Ó˹´ â´ÂÁÕÃËÑʢͧà«ÊªÑ¹ ID à«ÊªÑ¹ä´éÁÕ¡ÒèѴÊè§ â´Âãªé˹Öè§ã¹ÇÔ¸Õ¡ÒõèÍ仹Õé:

• ÃËÑÊÃͺàÇÅÒà»ç¹Êèǹ˹Ö觢ͧ¤Ø¡¡Õé·Õè¶Ù¡Êè§ä»ÂѧàºÃÒÇìà«ÍÃì¢Í§¼Ùéãªé
• ID à«ÊªÑ¹¶Ù¡½Ñ§ÍÂÙèã¹ URL à·¤¹Ô¤¹Õé¨ÐàÃÕ¡ÇèÒà»ç¹à«ÊªÑ¹¤Ø¡¡ÕéÍÂèÒ§¹éÍ¡ÇèÒ.

à«ÊªÑ¹ä´éà¢éÒÃËÑÊà»ç¹µÑÇàÅ¢ÊØèÁ 120 ºÔµ«Öè§áÊ´§ â´ÂʵÃÔ§·Õè 20 ÍÑ¡¢ÃÐ ÊÒÂÍÑ¡¢Ãж١¨Ñ´ÃٻẺà¾×èÍãËéÊÒÁÒö¶Ù¡ÃÇÁäÇéã¹ URL áÅÐäÁèÁÕ¡Òà undergo URL 㹡ÒÃà¢éÒÃËÑÊ µÑÇÍÂèÒ§àªè¹ ʵÃÔÍÒ¨¶Ù¡ãªéã¹à«ÊªÑ¹¹éÍ¡ÇèҤء¡Õé ÇÔ¸Õ¡ÒÃÊè§ËÁÒÂàÅ¢¢Í§à«ÊªÑ¹·ÕèãªéºèÍ·ÕèÊØ´ä´é â´Âãªé¤Ø¡¡Õéà¾×èÍà¡çº¤èÒÃËÑʢͧà«ÊªÑ¹

àÁ×èͼÙéãªé¡è͹ à»Ô´àÇçºàºÃÒÇìà«ÍÃì¢Í§µ¹ áÅÐä»ÂѧàÇçºä«µì·ÕèãªéʶҹÐà«ÊªÑ¹ ASP.NET ¤Ø¡¡Õé¶Ù¡Êè§ä»ÂѧàºÃÒÇìà«ÍÃì ÁÕª×èÍ "ASP.NET_SessionId" áÅФèÒ 20 ÍÑ¡¢ÃÐ

àÁ×èͼÙéãªéÀÒÂã¹â´àÁ¹ DNS à´ÕÂǡѹ¤é¹ àÇçºàºÃÒÇìà«ÍÃìÂѧ¤§ÁÕÍÂÙèà¾×èÍ·ÕèÊ觤ء¡Õé¹Õé¡Ñºâ´àÁ¹·Õè¨Ð¶Ù¡ sourced

µÑÇÍÂèÒ§àªè¹ app1.tailspintoys.com áÅÐ app2.tailspintoys.com à»ç¹â»Ãá¡ÃÁ»ÃÐÂØ¡µì ASP.NET ·Ñé§Êͧ ¶éÒ¼Ùéãªéä»Âѧ app1.tailspintoys.com áÅÐä» app2.tailspintoys.com áÍ»¾ÅÔपѹ·Ñé§Êͧ¨Ðãªé¤Ø¡¡Õé·ÕèàËÁ×͹¡Ñ¹áÅÐËÁÒÂàÅ¢à«ÊªÑ¹à´ÕÂǡѹà¾×è͵ԴµÒÁʶҹÐà«ÊªÑ¹¢Í§¼ÙéãªéÀÒÂã¹áµèÅÐá;ÅÔपѹ â»Ãá¡ÃÁ»ÃÐÂØ¡µìäÁèÃèÇÁʶҹÐà«ÊªÑ¹à´ÕÂǡѹ â»Ãá¡ÃÁ»ÃÐÂØ¡µìÃËÑÊà«ÊªÑ¹·ÕèãªéÃèÇÁ¡Ñ¹à·èÒ¹Ñé¹

´Ñ§¹Ñé¹ ¤Ø³ÊÒÁÒö·Õè¹ÓÁÒãªéà«ÊªÑ¹·ÕèÃËÑÊËÅÒÂÊÒà赯 µÑÇÍÂèÒ§àªè¹ ¶éҤس¹ÓÁÒãªéà«ÊªÑ¹ÃËÑÊ ¤Ø³äÁè¨Óà»ç¹µéͧ´Óà¹Ô¹¡ÒõèÍ仹Õé:

• ÊÃéÒ§ËÁÒÂàÅ¢¢Í§à«ÊªÑ¹·ÕèäÁè«éӡѹ cryptographically ãËÁèàÁ×èͤس¹ÓàÊ¹Í ÁÕÃËÑÊ¡ÒÃà«ÊªÑ¹·Õè¶Ù¡µéͧ
• ÊÃéÒ§¡ÒÃÃËÑÊà«ÊªÑ¹ãËÁèÊÓËÃѺâ»Ãá¡ÃÁ»ÃÐÂØ¡µì ASP.NET ·Ñé§ËÁ´·ÕèÍÂÙèã¹â´àÁ¹à´ÕÂÇ

àÁ×èÍâ»Ãá¡ÃÁ»ÃÐÂØ¡µìàÇ纷Õè¨Óà»ç¹µéͧà¢éÒÊÙèÃкºáºº áÅÐÅçÍ¡ÍÍ¡¨Ò¡Ë¹éÒËÃ×͵ÑÇàÅ×Í¡¡ÒùÓàÊ¹Í àÃÒ¢Íá¹Ð¹ÓãËé ¤Ø³ÅéÒ§¢éÍÁÙÅʶҹÐà«ÊªÑ¹àÁ×èÍÁÕ¡ÒÃà¢éÒÊÙèÃкº¼ÙéãªéÍÍ¡¨Ò¡àÇçºä«µì àÁ×è͵éͧ¡ÒÃÅéÒ§¢éÍÁÙÅʶҹÐà«ÊªÑ¹ àÃÕ¡¡ÒÃSession.AbandonÇÔ¸Õ¡Òà ¡Ãкǹ¡ÒÃSession.AbandonÇÔ¸Õ¡ÒêèÇÂãËé¤Ø³ÊÒÁÒöÅéҧʶҹÐà«ÊªÑ¹â´ÂäÁèä´é¡ÓÅѧÃÍ¡ÒÃËÁ´àÇÅҢͧʶҹÐà«ÊªÑ¹ â´Â¤èÒàÃÔèÁµé¹ ¡ÒÃËÁ´àÇÅÒ¹Õé¨ÐËÁ´ÍÒÂØ¡Òà sliding 20 ¹Ò·Õ ËÁ´ÍÒÂعÕé¡ÓÅѧ¿×鹿ٷء¤ÃÑ駷Õè¼Ùéãªé·Ó¡ÒÃÃéͧ¢ÍãËéä»àÇçºä«µì áÅÐáÊ´§¤Ø¡¡Õé ID ¢Í§à«ÊªÑ¹ ¡Ãкǹ¡ÒÃabandonÇÔ¸ÕµÑ駤èÒʶҹÐã¹Çѵ¶ØʶҹÐà«ÊªÑ¹·Õèºè§ªÕéÇèÒ ¤ÇèСʶҹÐà«ÊªÑ¹ ¤èÒʶҹÐà»ç¹ examined áÅШҡ¹Ñé¹ ´Óà¹Ô¹Êèǹ·éÒ¢ͧ¡ÒÃÃéͧ¢Íྨ ´Ñ§¹Ñé¹ ¼ÙéãªéÊÒÁÒöãªéÇѵ¶Ø¢Í§à«ÊªÑ¹ÀÒÂã¹Ë¹éÒËÅѧ¨Ò¡·Õè¤Ø³àÃÕ¡ãªé¡ÒÃabandonÇÔ¸Õ¡Òà ·Ñ¹·Õ·Õè¡ÒûÃÐÁÇżÅà¾àÊÃç¨ÊÁºÙóì à«ÊªÑ¹¶Ù¡ÅºÍÍ¡

àÁ×èͤسãªéâËÁ´ÊÀÒÇТͧà«ÊªÑ¹ã¹¡Ãкǹ¡Òà Íͺà¨ç¡µìʶҹÐà«ÊªÑ¹àËÅèÒ¹Õé¶Ù¡à¡çºäÇéã¹ HttpCache The HttpCache supports a callback method when the following conditions are true:

• A cache entry is removed.
• The Session State Manager registers theSession_OnEndevent handler to be called when the cache entry is removed.

When the Session State Manager removes a session state object that resides in the cache, the HttpCache manager will call any registered callbacks. In effect, this behavior raises theSession_OnEndµÑǨѴ¡ÒÃà˵ءÒóì

When you abandon a session, the session ID cookie is not removed from the browser of the user. Therefore, as soon as the session has been abandoned, any new requests to the same application will use the same session ID but will have a new session state instance. At the same time, if the user opens another application within the same DNS domain, the user will not lose their session state after theAbandonmethod is called from one application.

Sometimes, you may not want to reuse the session ID. If you do and if you understand the ramifications of not reusing the session ID, use the following code example to abandon a session and to clear the session ID cookie:This code example clears the session state from the server and sets the session state cookie to null. The null value effectively clears the cookie from the browser.

When a user does not log off from the application and the session state time-out occurs, the application may still use the same session state cookie if the browser is not closed. This behavior causes the user to be directed to the logon page and the session state cookie of the user to be presented. To guarantee that a new session ID is used when you open the logon page (login.aspx), send a null cookie back to the client. To do this, add a cookie to the response collection. Then, send the response collection back to the client. The easiest way to send a null cookie is by using theResponse.RedirectÇÔ¸Õ¡ÒÃ Because the cookies collection always has a value for the ASP.NET_SessionId, you cannot just test if this cookie exists because you will create aResponse.RedirectLoop You can set a query string on the redirect to the logon page.

Or, as illustrated in the following code example, you can use a different cookie to tell if you are already redirected to the logon page. To help enhance security and to make sure that no one tries to open the logon page by using a second cookie together with the ASP.NET cookie, the following code example uses theFormsAuthenticationclass to encrypt and decrypt the cookie data. Then, the code example sets a 5-second time-out.