temp files & user sessions

[iwuser]

A lot of stuff in IW does not appear to have any documentation, or I was unable to find it. Hence I keep running into small issues and need clarifications:

I'm creating lots of tmp files with TIWAppCache.AddFileToCache(self,... calls or similar, using ctSession flag, and then serve them to client on request.

I believe it creates a new session every time the link is refreshed - I can see it in my logs. Every refresh would send me different URL parameters, this is how it works attached to my target 3rd-party system in a frame. But I think it must be resetting something in the requests for me. Because if I keep reloading the page with different parameters in a browser manually, it only loads the 1st time and completely ignores it when the parameters change, returning the same 1st page, so it apparently remembers my session and I probably need to add code to reset it on getting new parameters. How/Where can I do this?

There's also a UserSession module and I can see from the logs that it creates user sessions. But UserSession object does not know its own session name/ID. Can I get it from WebAllpication or something?

In the file system I can see temp folders created and then user session subfolders created underneath those.

But all temp files are created in the root of the temp folders, not under user session subfolders - those stay empty for me. How can I control where the temp files go to? How do ctSession/ctForm, etc. work exactly?

What is the TIWServerController.SessionOptions.LockSessionTimeout for?

Can I explicitly close my session, i.e.: on service stopping, so that it cleans up the temp files for me?

I need all these details, because it's going to be handling zillions of files a day and it has to clean it up consistently, or it will quickly run out of disk space.

Is there some doc somewhere where it's all detailed in?


It's the latest IW, in http.sys service, BTW. Delphi 10.4.1.

[Alexandre Machado]

> I believe it creates a new session every time the link is refreshed

What link is that? A request for a file should not create a new session. Most files are served even without session validation. If this is happening, something is wrong with the links and/or the way they are being created/served.

> But UserSession object does not know its own session name/ID. Can I get it from WebAllpication or something?

UserSession knows it's IWApplication instance. You need o reference it via WebApplication. Each IWApplication instance is tied to a single user session (both logical and the actual UserSession object instance). E.g.

UserSession.WebApplication

> But all temp files are created in the root of the temp folders, not under user session subfolders

The cache system uses a common folder for all cache files regardless of the session. That's by design. You can set the cache folder for your application but you can't control how the files are saved inside it.

> What is the TIWServerController.SessionOptions.LockSessionTimeout for?

When IW is processing a request for a specific user session it will block other requests for the same session (don't confuse this with serializing requests for all other sessions). The LockSessionTimeout is the time it will wait for the first request to be completed, before rejecting the second request for *the same session*.

Example: Your user clicks on a button to generate a big report. It takes 3 or 4 minutes to generate it. Meanwhile, the same user gets impatient and decides to click on another button which triggers another action. This action will need to wait until the report is finished. The time it will wait is defined by this property. If the report finishes before the LockSessionTimeout expires, the second action will be executed. Otherwise, the user will receive an error message.

>Can I explicitly close my session, i.e.: on service stopping, so that it cleans up the temp files for me?

IW will do the proper clean-up of everything for you. When sessions are destroyed all files related to that session are deleted.

[iwuser]

> I believe it creates a new session every time the link is refreshed

What link is that? A request for a file should not create a new session. Most files are served even without session validation. If this is happening, something is wrong with the links and/or the way they are being created/served.

> But UserSession object does not know its own session name/ID. Can I get it from WebAllpication or something?

UserSession knows it's IWApplication instance. You need o reference it via WebApplication. Each IWApplication instance is tied to a single user session (both logical and the actual UserSession object instance). E.g.

UserSession.WebApplication

> But all temp files are created in the root of the temp folders, not under user session subfolders

The cache system uses a common folder for all cache files regardless of the session. That's by design. You can set the cache folder for your application but you can't control how the files are saved inside it.

> What is the TIWServerController.SessionOptions.LockSessionTimeout for?

When IW is processing a request for a specific user session it will block other requests for the same session (don't confuse this with serializing requests for all other sessions). The LockSessionTimeout is the time it will wait for the first request to be completed, before rejecting the second request for *the same session*.

Example: Your user clicks on a button to generate a big report. It takes 3 or 4 minutes to generate it. Meanwhile, the same user gets impatient and decides to click on another button which triggers another action. This action will need to wait until the report is finished. The time it will wait is defined by this property. If the report finishes before the LockSessionTimeout expires, the second action will be executed. Otherwise, the user will receive an error message.

>Can I explicitly close my session, i.e.: on service stopping, so that it cleans up the temp files for me?

IW will do the proper clean-up of everything for you. When sessions are destroyed all files related to that session are deleted.

1) Sorry, my terminology, not a link: I have my application called from a 3rd-party webpage. It changes URL parameters every time it loads/opens it. And my app creates a new session / new form every time it's reloaded, which is exactly what I want. But if I type the URL with some parameters into a browser address box, open the page and then change the parameters and re-open it, it does not create a new session / form, nor changes the page it serves back to caller. Even if I clear browser caches in between.

2) Again, I may not have described it well: with UserSession.WebApplication, can I get some unique ID that I can print in the log that identifies this session?

3) LockSessionTimeout> thanks, got it.

4) Ok, but with 1) above in mind, I was thinking that maybe I could see the new request has different parameters and close the old session / force it to start a new one?

[iwuser]

For example, I open:

https:/myserver/url?X=1

It creates a new session, new form, processes the X=1 parameter and returns relevant data, all is good.

Then in the same window, I navigate manually to https:/myserver/url?X=2 and I can see the connection coming through in IWServerControllerBaseExecuteRequest with the new parameters, but it apparently picks up the session from the cookies and does not create a new session/new form for me in this case, so I never process the new parameters and the server return the same old page with the data for X=1, which is now wrong.

Somehow, when it's called by this 3rd-party application in Firefox, Edge or Chrome, it behaves completely differently and everything works. But in IE, it's inconsistent and often falls back to what I see with manually changing the URL, as per above.

So when I see in IWServerControllerBaseExecuteRequest that the parameters have changed, I want to kill the current session and make it create a new one (hopefully automatically, or if not then create one manually myself). What do I need to do to achieve this, please?

PS: If I change CookieOptions in the ServerController to disable Cookies (UseCookies & SessionCookies = FALSE), it actually fixes this issue for me. But is this a good solution? Should I instead keep cookies and recreate the session as per above?