Keep-alive forms don't work as expected

[Blanca80]

Hello, 

We're experiencing some strange behaviour with the sessions on one of our clients. The program runs on an IIS and it's an ISAPI application connected to a database that basically manages the lawyer's files with some menus and forms that interact. 

The client wants that the session they are working in will never expires until they don' close the window browser, and this can be hours with the browser opened but without user's interaction. To do so, we have setted all forms with the keep-alive true and lengthened the servercontroller sessiontimeout to 240 minutes.  

If perhaps the applicaton remains an hour and the user comes back to the form and clicks on it, sometimes the application returns to the main page and starts another session instead of remaining to the form with same data they've leaved an hour ago, without errors and without closing the session.  

If we look at the server we suspect that the previous session is still running, but impossible to reach, and surely a new session has been created. 

I've recently changed sessioncookies to false but it's the same and i think usecookies it's mandatory as we work with sessions.

What else can we review? 

Thank you very much.

[joelcc]

Are you setting the KeepAlive on the forms?   Do not get that mixed up with the httpKeepAlive property they are not the same.

When the forms KeepAlive is true then the form will send a ping multiple times during the sessiontimeout setting to make sure it keeps the form alive.

Because of this you will want to keep the sessiontimeout value fairly low.   We set ours to 10 min.   That way when the browser is closed the session will closeout after the 10 min mark and no ping is received.

You might search the user group for more explaination like this thread:  https://www.atozed.com/forums/archive/in...-1040.html

[Blanca80]

Are you setting the KeepAlive on the forms?   Do not get that mixed up with the httpKeepAlive property they are not the same.

When the forms KeepAlive is true then the form will send a ping multiple times during the sessiontimeout setting to make sure it keeps the form alive.

Because of this you will want to keep the sessiontimeout value fairly low.   We set ours to 10 min.   That way when the browser is closed the session will closeout after the 10 min mark and no ping is received.

You might search the user group for more explaination like this thread:  https://www.atozed.com/forums/archive/in...-1040.html

"we have setted all forms with the keep-alive true and lengthened the servercontroller sessiontimeout to 240 minutes. " That's the configuration we have made, but in some cases after an hour of user's no activity the session is restarted when the user wants to go back to the form and clicks on it but contrary of what we thought the session is effectively closed.

We first thought that the suspension mode on the pc could interfiere on the keep-alive requesting sends but it is not, because the suspending mode has been disabled and the client reports the same mistake. 



And yet another question: On the link https://www.atozed.com/2022/12/terminati...-sessions/ it says:

It's important to clarify that Intraweb has a thread that runs in the background - at 1 minute intervals- and does the clean up of all unused sessions,

If we look at the Intraweb session log viewer there are lot of sessions that should be expired but they don't, the messages are like this:

Created at: 14/10/2024 15:01:48
Destroyed at: The session was still active when this file was last written to.
Remote IP address: x95.xxx.5x.x6
Browser name: Chrome
Browser user agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Duration:  19 hours 38 minutes 55 seconds
Request count: 41
Last Access: 14/10/2024 15:02:42
This session should be expired!

what does it mean? is the thread working or not? 

There's one more thing: if i leave the form without interaction for minutes begins the countdown timeout although it has the keep-alive setted to true.


thank you

[joelcc]

I am not sure you understand how keep alive works. It sends a ping so many times per your session timeout setting to reset the countdown. If the browser stops communication with the server through the ping when it hits your sessiontimeout limit it will close the session.

[Blanca80]

I am not sure you understand how keep alive works.  It sends a ping so many times per your session timeout setting to reset the countdown.  If the browser stops communication with the server through the ping when it hits your sessiontimeout limit it will close the session.

Appreciate,

Yes, thats what i've understood about keep-alive but, at least in our application, is not working at all, if we left the browser opened with the form but there is no activity the countdown starts after a period of time and finally closes the session and, as it has the keep-alive property on, it hasn't. 

i'll make a couple of tests cases today in order to see if it's a problem of our programming side or its a general bug of intraweb altough that implies to make an isapi application and set it in iis. 

Blanca

[DanBarclay]

I am not sure you understand how keep alive works.  It sends a ping so many times per your session timeout setting to reset the countdown.  If the browser stops communication with the server through the ping when it hits your sessiontimeout limit it will close the session.

Appreciate,

Yes, thats what i've understood about keep-alive but, at least in our application, is not working at all, if we left the browser opened with the form but there is no activity the countdown starts after a period of time and finally closes the session and, as it has the keep-alive property on, it hasn't. 

i'll make a couple of tests cases today in order to see if it's a problem of our programming side or its a general bug of intraweb altough that implies to make an isapi application and set it in iis. 

Blanca

It was mentioned before, but there is more than one keep-alive.  See the thread mentioned above for discussion of both.  They do both work, for their (different) purposes.

The only exception I've found is that browsers on mobile devices (iPhone for certain) go dead if they are not in view.  That is, if they are put in background or the phone is closed they go dead and do not send the ping.   I do not know of other browsers that do this but I haven't checked in a while.  

What browser/OS are you using?   IW/Delphi version?

Dan

[Blanca80]

I am not sure you understand how keep alive works.  It sends a ping so many times per your session timeout setting to reset the countdown.  If the browser stops communication with the server through the ping when it hits your sessiontimeout limit it will close the session.

Appreciate,

Yes, thats what i've understood about keep-alive but, at least in our application, is not working at all, if we left the browser opened with the form but there is no activity the countdown starts after a period of time and finally closes the session and, as it has the keep-alive property on, it hasn't. 

i'll make a couple of tests cases today in order to see if it's a problem of our programming side or its a general bug of intraweb altough that implies to make an isapi application and set it in iis. 

Blanca

It was mentioned before, but there is more than one keep-alive.  See the thread mentioned above for discussion of both.  They do both work, for their (different) purposes.

The only exception I've found is that browsers on mobile devices (iPhone for certain) go dead if they are not in view.  That is, if they are put in background or the phone is closed they go dead and do not send the ping.   I do not know of other browsers that do this but I haven't checked in a while.  

What browser/OS are you using?   IW/Delphi version?

Dan

Hello Dan ,

I hope you are fine. Here's the result of the session log of an application running on Chrome and maded with Delphi 11.3. As you can see, it's running from 11.14 am and not closed by user but remotely ended by application. The application has setted on keep-alive in all the forms, at least the form that was oppened in the browser, and its timeout is for five minutes. I don't know why the sessions suddenly shut down.  

Created at: 21/10/2024 11:14:26
Destroyed at: 21/10/2024 15:08:26
Remote IP address: x9.xx5.1xx.x5
Browser name: Chrome
Browser user agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Duration:  3 hours 54 minutes
Request count: 80
Last Access: 21/10/2024 14:08:45

(The remote ip was masked for security reasons) 

You mentioned in the threat that The MyForm.Keepalive works by knowing the timeout delay (X) and sending a message to the server about 3 or 4 times during that time.
It's possible that this isn't going or maybe there's a moment that stops to sending messages?