ASP.NET C# : Working With Cookies

If enabled on client browsers, cookies are a great way to store bits of data for use by websites like remembering the login state of users who doesn't want to retype their username and password everytime they visit the site.


Here are the most common functions you can use to manipulate cookies in ASP.NET (C#):


SETCOOKIE
public void SetCookie(string name, string value, int expiration)
{
    HttpCookie cookie;
    if (Request.Cookies[name] == null) cookie = new HttpCookie(name);
    else cookie = Request.Cookies[name];
    cookie.Value = value;
    cookie.Expires = DateTime.Now.AddDays(expiration);
    Response.Cookies.Add(cookie);
}


SetCookie can be used to add a new cookie or overwrite an exisiting one in your cookie collection. Simply pass the name and value pair and the expiration (in days) for how long you want that cookie to be in use by your website. In the following code, we store the username "abby" in our collection for 1 day.


SetCookie("username", "abby", 1);


Take note though that if you use the same cookie name "username" again to set another value, it will overwrite the previous one.


GETCOOKIE
public string GetCookie(string name)
{
    HttpCookie cookie = Request.Cookies[name];
    if (cookie == null) return "";
    else return cookie.Value;
}


GetCookie can be used to retrieve the value of the cookie by passing the name. In the following code, we get the value of the cookie considering it has not yet expired.


string str = GetCookie("username");


DELETECOOKIE
public void DeleteCookie(string name)
{
    HttpCookie cookie;
    if (Request.Cookies[name] == null) return;
    else cookie = Request.Cookies[name];
    cookie.Expires = DateTime.Now.AddDays(-1);
    Response.Cookies.Add(cookie);
}


DeleteCookie can be used to delete a particular cookie from the cookie collection by passing the name. Notice the -1 in the AddDays? That will simply delete the value in the physical cookie file. In the following code, we delete the "username" cookie.


DeleteCookie("username");


CLEARCOOKIES
public void ClearCookies()
{
    int cookieCount = Request.Cookies.Count;


    for (int i = 0; i < cookieCount; i++)
    {
        HttpCookie cookie = Request.Cookies[i];
        cookie.Expires = DateTime.Now.AddDays(-1);
        Response.Cookies.Add(cookie);
    }
}


ClearCookies can be used to delete all cookies in the cookie collection. We also used the -1 in the AddDays here but used a loop to delete each one in the collection. In the following code, it will delete the physical cookie file of your website.


ClearCookies();






And that's it for cookies.


-k

ASP.NET Logout on Session Expire

Here's a way to enable logout after session has expired in your ASP.NET pages.


Let us begin with the sessionState tag inside the web.config file:


<system.web>
    <sessionState mode="InProc" cookieless="false" timeout="30"/>
</system.web>


Make sure to place it inside the system.web tag. For the attributes, we use InProc mode to store the session on the local computer, cookieless is set to false which means it will store the session as cookies (if you set this to true, you will get some jumbled alphanumeric characters in your webpage's URL) and finally timeout which has a numeric value equal to how long you want your session in minutes before it expires.


For more information on sessionState attributes, check out msdn: http://msdn.microsoft.com/en-us/library/h6bb9cz9(VS.71).aspx


Now the snippet above alone will not make your page redirect automatically to your logout page after session has expired. We still need human intervention to enable that. So we add this next logic to the Master Page's page_load event (or to all pages of a website if you're not using master pages):



protected void Page_Load(object sender, EventArgs e)
{
    //1st: Every postback should pass through this code.
    //     Make a decision statement to check if user has already logged in.
    if (user has already logged in)
    {
        //2nd: Check your user session. 
               If session is null (expired) then continue.
        if (Session["user_session"] == null)
        {
            //3rd: Clear all sessions, data, connections, etc. (optional)
                   Redirect to logout page.
            .
            .
            .
            Page.Response.Redirect("logout_page", true);
        }
    }
}






Handling session expiration is required for web pages which uses sessions to store data so you won't encounter the object reference not set to an instance of an object error should your session objects expire.


-k