通過Global.asax文件里面的Session_End事件記錄用戶退出 (or session timeout)

Session.Abandon()和timeout會觸發Global.asax的Session_End事件。可以通過這個事件來記錄用戶退出或者session timeout，這樣每個用戶都會有一條登陸和退出記錄。

退出登陸調用方法：

public void PerformLogout()
{
    HttpContext.Current.Session["PerformLogout"] = true;
    HttpContext.Current.Session.Abandon();
}

Session_End事件代碼：　　

protected void Session_End(Object sender, EventArgs e)
{
    BusinessContext bizContext = (BusinessContext)Session["BusinessContext"];
    string loginID = string.IsNullOrEmpty(bizContext.LoginID) ? "" : bizContext.LoginID;
    string title = "Timeout";
    if (Convert.ToBoolean(Session["PerformLogout"]))
    {
        title = "Logout";
    }
    BusinessEvent.Log(BizLogCategory.SECURITY, BizLogModule.USER_AUTHENTICATION, title, "[PerformLogout]Logout Successfully", "LoginID: " + loginID, bizContext);
}

有如下幾點需要注意：

1. 盡管我們先調用Session.Abandon()，但是在Session_End事件里還是可以繼續訪問所有session的值。正是因為這個，所以我們可以在PerformLogout方法中給Session["PerformLogout"]賦值，然后通過這個值來判斷Session_End事件是由用戶登出觸發還是由session timeout觸發。

2. ASP.NET里面Session和HttpContext.Current.Session對象都指向System.Web.SessionState.HttpSessionState，大部分地方這兩個對象可以互換使用，但是在Session_End事件里，HttpContext.Current返回的是null，所以只能通過Session對象來訪問session值。為什么要這樣寫，參考這里

3. 引起session timeout的設置比較多，測試過的有web.config里面的sessionState timeout, IIS Application Pools的Idle Time-out, IIS Application Pools Recycle, Stop website, 修改web.config等。

 

https://msdn.microsoft.com/en-us/library/system.web.sessionstate.sessionstatemodule.end(v=vs.110).aspx
https://msdn.microsoft.com/en-us/library/system.web.sessionstate.httpsessionstate.abandon(v=vs.110).aspx
http://forums.asp.net/t/1275683.aspx?Can+t+access+to+Session+variable+inside+Session_End+Event
http://stackoverflow.com/questions/940742/difference-between-session-and-httpcontext-current-session
http://stackoverflow.com/questions/27657773/why-is-httpcontext-current-null-during-the-session-end-event
http://stackoverflow.com/questions/19509672/why-is-httpcontext-current-null
http://stackoverflow.com/questions/12294532/asp-net-values-of-session-variables-in-session-end-event
https://msdn.microsoft.com/en-us/library/system.web.sessionstate.httpsessionstate.abandon.aspx
https://msdn.microsoft.com/en-us/library/system.web.sessionstate.sessionstatemodule.end.aspx
http://stackoverflow.com/questions/13264212/on-session-timeout-capture-info
http://www.beansoftware.com/ASP.NET-Tutorials/Find-If-Session-Expired.aspx