Like Airlines website - Redirect to results page after getting res

Hi everyone,
I have a ASP page that triggers a db-side stored procedure. At the end of
the procedure, it spits out a log file, that this ASP page reads and displays
for the users.

But the problem is that the database-stored Proc could take anything between
10 secs - to - 10 mins. I dont want the page to time out [But I dont want to
increase the time out in the IIS webserver]. Is there a way, like the
airlines websites do, where I can just show an animated gif while the
procedure runs and redirect the page to results at the end of the procedure
run.

ex: like orbitz or hotwire.... or anything like that, but not as complicated
as them.

Hope I made my question clear,

any ideas are truely appreciated,
_Mac

Bob
Mon May 15 15:07:06 CDT 2006

Uday wrote:
> Hi everyone,
> I have a ASP page that triggers a db-side stored procedure. At the
> end of the procedure, it spits out a log file, that this ASP page
> reads and displays for the users.
>
> But the problem is that the database-stored Proc could take anything
> between 10 secs - to - 10 mins. I dont want the page to time out [But
> I dont want to increase the time out in the IIS webserver]. Is there
> a way, like the airlines websites do, where I can just show an
> animated gif while the procedure runs and redirect the page to
> results at the end of the procedure run.

?? What happens if the user closes the browser?
>
> ex: like orbitz or hotwire.... or anything like that, but not as
> complicated as them.
>
Not without some client-side code (see a javascript/jscript newsgroup). You
could use an xmlhttp object (AJAX) to periodically (using setTimeout) submit
to a server-side page that checks to see if the process is complete.
However, this could be very insecure: since it's all in client-side script,
it's visible to anyone who is knowledgeable enough to View Source or
retrieve the script from the browser cache (not at all hard to do). You
really need to know what you are doing to ensure that a user's session
cannot be hijacked.

--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

Anthony
Tue May 16 02:24:56 CDT 2006


"Bob Barrows [MVP]" <reb01501@NOyahoo.SPAMcom> wrote in message
news:eI8phsFeGHA.4892@TK2MSFTNGP02.phx.gbl...
> Uday wrote:
> > Hi everyone,
> > I have a ASP page that triggers a db-side stored procedure. At the
> > end of the procedure, it spits out a log file, that this ASP page
> > reads and displays for the users.
> >
> > But the problem is that the database-stored Proc could take anything
> > between 10 secs - to - 10 mins. I dont want the page to time out [But
> > I dont want to increase the time out in the IIS webserver]. Is there
> > a way, like the airlines websites do, where I can just show an
> > animated gif while the procedure runs and redirect the page to
> > results at the end of the procedure run.
>
> ?? What happens if the user closes the browser?
> >
> > ex: like orbitz or hotwire.... or anything like that, but not as
> > complicated as them.
> >
> Not without some client-side code (see a javascript/jscript newsgroup).
You
> could use an xmlhttp object (AJAX) to periodically (using setTimeout)
submit
> to a server-side page that checks to see if the process is complete.
> However, this could be very insecure: since it's all in client-side
script,
> it's visible to anyone who is knowledgeable enough to View Source or
> retrieve the script from the browser cache (not at all hard to do). You
> really need to know what you are doing to ensure that a user's session
> cannot be hijacked.

How does using this approach expose the session to a greater risk of
hijacking?

>
> --
> Microsoft MVP - ASP/ASP.NET
> Please reply to the newsgroup. This email account is my spam trap so I
> don't check it very often. If you must reply off-line, then remove the
> "NO SPAM"
>
>

Bob
Tue May 16 05:31:01 CDT 2006

Anthony Jones wrote:
>> Not without some client-side code (see a javascript/jscript
>> newsgroup). You could use an xmlhttp object (AJAX) to periodically
>> (using setTimeout) submit to a server-side page that checks to see
>> if the process is complete. However, this could be very insecure:
>> since it's all in client-side script, it's visible to anyone who is
>> knowledgeable enough to View Source or retrieve the script from the
>> browser cache (not at all hard to do). You really need to know what
>> you are doing to ensure that a user's session cannot be hijacked.
>
> How does using this approach expose the session to a greater risk of
> hijacking?
>
The ID used to identify the asynchronous process may need to be part of the
xmlhttp submission, and, if the session ID is not being used, then that ID
will appear in plain text in the page's source. If the ID is something like
a user's email address or name, then it's guessable, right?
--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"

Anthony
Tue May 16 07:21:35 CDT 2006


"Bob Barrows [MVP]" <reb01501@NOyahoo.SPAMcom> wrote in message
news:%239JxQPNeGHA.564@TK2MSFTNGP02.phx.gbl...
> Anthony Jones wrote:
> >> Not without some client-side code (see a javascript/jscript
> >> newsgroup). You could use an xmlhttp object (AJAX) to periodically
> >> (using setTimeout) submit to a server-side page that checks to see
> >> if the process is complete. However, this could be very insecure:
> >> since it's all in client-side script, it's visible to anyone who is
> >> knowledgeable enough to View Source or retrieve the script from the
> >> browser cache (not at all hard to do). You really need to know what
> >> you are doing to ensure that a user's session cannot be hijacked.
> >
> > How does using this approach expose the session to a greater risk of
> > hijacking?
> >
> The ID used to identify the asynchronous process may need to be part of
the
> xmlhttp submission, and, if the session ID is not being used, then that ID
> will appear in plain text in the page's source. If the ID is something
like
> a user's email address or name, then it's guessable, right?

I see what you mean.

With or without using the Session ID it's still a good idea to allocate a
unique ID to the process. A GUID would be a good choice coupled with a
comparison of REMOTE_ADDR to which the GUID was originally issued.


> --
> Microsoft MVP - ASP/ASP.NET
> Please reply to the newsgroup. This email account is my spam trap so I
> don't check it very often. If you must reply off-line, then remove the
> "NO SPAM"
>
>

Michael
Wed May 17 11:49:45 CDT 2006

Uday wrote:
> Hi everyone,
> I have a ASP page that triggers a db-side stored procedure. At the end of
> the procedure, it spits out a log file, that this ASP page reads and displays
> for the users.
> But the problem is that the database-stored Proc could take anything between
> 10 secs - to - 10 mins. I dont want the page to time out [But I dont want to
> increase the time out in the IIS webserver]. Is there a way, like the
> airlines websites do, where I can just show an animated gif while the
> procedure runs and redirect the page to results at the end of the procedure
> run.
> ex: like orbitz or hotwire.... or anything like that, but not as complicated
> as them.
> Hope I made my question clear,
> any ideas are truely appreciated,
> _Mac

Rather than tie up the user's browser, you could do the following:

allocate a unique identifier (GUID, random number) embedded in a URL:
e.g. http://www.mysite.com/scheduledjobs?jobid=123456
and return that URL to the user with a message such as
"Request submitted: it will take some time to complete. Please click
<a href="http://www.mysite.com/scheduledjobs?jobid=123456">here</a>
to check for completion.
Or you could redirect to that URL immediately (see next item).

Create an ASP page, e.g.,
http://www.mysite.com/scheduledjobs
which, when passed a jobid value, checks to see whether the job (stored
procedure execution) with that jobid has completed. If so, the ASP page
redirects to a URL created by the stored procedure, (e.g.,
http://www.mysite.com/jobs/123456.log ). If, on the other hand, the
stored procedure hasn't finished, inform the user of that.

This allows the user to bookmark a report URL. They can periodically
return to see if the report has finished or e-mail the URL to someone.

So to reiterate:
1. The user executes a request to the URL, say,
http://www.mysite.com/jobrequest.asp?custid=55555
and is immediately returned a page, say
http://www.mysite.com/scheduledjobs.asp?jobid=123456
that shows a "report URL" where the finished report will later appear,

2. jobrequest.asp validates input data and stores request information
(jobid and all inputs) in a database table e.g., JOBTABLE.

3. A background job executes periodically or as requested, reading the
database table JOBTABLE and looking for new entries. When a new entry is
found, the stored procedure is executed and the output of the stored
procedure stored to a new report URL http://www.mysite.com/jobs/123456.log
Finally JOBTABLE is updated to indicate that the job completed and the
name of the report URL is entered into that table.

See http://aspfaq.com/show.asp?id=2143 for details on how to
trigger/schedule a background job.

4. scheduledjobs.asp, when passed a jobid, checks JOBTABLE and/or the
report URL to see if the jobid is valid and whether the job has
completed. If the job has completed, scheduledjobs.asp redirects to the
report URL for that jobid. Otherwise it informs the user that the jobid
does not exist or that the job has not completed. [Alternately
scheduledjobs.asp could have various utility functions as listing all
outstanding/completed jobs for that user or all users.]

5. Possibly write a periodic stored procedure to remove/archive old
report URLs and delete old entries from JOBTABLE.

Uday
Wed May 17 14:02:02 CDT 2006

Thanks Michael. Your suggestion sounds close to what I was looking for. I'll
try it. Thanks for your suggestions to Bob... I didn't get my hands dirty yet
with AJAX, so it sounds pretty complicated. But when I have more time, I'll
try your idea too.

thanks again,
_Uday
"Michael D. Kersey" wrote:

> Uday wrote:
> > Hi everyone,
> > I have a ASP page that triggers a db-side stored procedure. At the end of
> > the procedure, it spits out a log file, that this ASP page reads and displays
> > for the users.
> > But the problem is that the database-stored Proc could take anything between
> > 10 secs - to - 10 mins. I dont want the page to time out [But I dont want to
> > increase the time out in the IIS webserver]. Is there a way, like the
> > airlines websites do, where I can just show an animated gif while the
> > procedure runs and redirect the page to results at the end of the procedure
> > run.
> > ex: like orbitz or hotwire.... or anything like that, but not as complicated
> > as them.
> > Hope I made my question clear,
> > any ideas are truely appreciated,
> > _Mac
>
> Rather than tie up the user's browser, you could do the following:
>
> allocate a unique identifier (GUID, random number) embedded in a URL:
> e.g. http://www.mysite.com/scheduledjobs?jobid=123456
> and return that URL to the user with a message such as
> "Request submitted: it will take some time to complete. Please click
> <a href="http://www.mysite.com/scheduledjobs?jobid=123456">here</a>
> to check for completion.
> Or you could redirect to that URL immediately (see next item).
>
> Create an ASP page, e.g.,
> http://www.mysite.com/scheduledjobs
> which, when passed a jobid value, checks to see whether the job (stored
> procedure execution) with that jobid has completed. If so, the ASP page
> redirects to a URL created by the stored procedure, (e.g.,
> http://www.mysite.com/jobs/123456.log ). If, on the other hand, the
> stored procedure hasn't finished, inform the user of that.
>
> This allows the user to bookmark a report URL. They can periodically
> return to see if the report has finished or e-mail the URL to someone.
>
> So to reiterate:
> 1. The user executes a request to the URL, say,
> http://www.mysite.com/jobrequest.asp?custid=55555
> and is immediately returned a page, say
> http://www.mysite.com/scheduledjobs.asp?jobid=123456
> that shows a "report URL" where the finished report will later appear,
>
> 2. jobrequest.asp validates input data and stores request information
> (jobid and all inputs) in a database table e.g., JOBTABLE.
>
> 3. A background job executes periodically or as requested, reading the
> database table JOBTABLE and looking for new entries. When a new entry is
> found, the stored procedure is executed and the output of the stored
> procedure stored to a new report URL http://www.mysite.com/jobs/123456.log
> Finally JOBTABLE is updated to indicate that the job completed and the
> name of the report URL is entered into that table.
>
> See http://aspfaq.com/show.asp?id=2143 for details on how to
> trigger/schedule a background job.
>
> 4. scheduledjobs.asp, when passed a jobid, checks JOBTABLE and/or the
> report URL to see if the jobid is valid and whether the job has
> completed. If the job has completed, scheduledjobs.asp redirects to the
> report URL for that jobid. Otherwise it informs the user that the jobid
> does not exist or that the job has not completed. [Alternately
> scheduledjobs.asp could have various utility functions as listing all
> outstanding/completed jobs for that user or all users.]
>
> 5. Possibly write a periodic stored procedure to remove/archive old
> report URLs and delete old entries from JOBTABLE.
>