ASP.NET Session TimeOut problem

Question

I have a wired scenario in one of my ASP.net application.

I am using ASP.net membership with my custom "roleManager",

and having below tag in web.config to restrict any user not having role of "Keywords"(roles) to access "Keywords"(path) folder

<location path="Keywords">

<system.web>

<authorization>

<allow roles="Keywords"/>

<deny users="*" />

</authorization>

</system.web>

</location>

If any user with some other role allow to assess this URL (Keywords in this case) will be redirected to a custom- Access denied page.

Now things working fine but when I left my application with a inactivity of 30 min I am not able to visit the "Keywords", all the time I end up with the custom- Access denied page, if I close the browser, login again it start working fine.

Please help me in this case.

Thanks in advance

Are you logging in with FormsAuthentication? if so, have you checked that the cookie is reloaded for the user? msdn.microsoft.com/en-us/library/… — Pieter Germishuys
– Pieter Germishuys, Commented Feb 9, 2011 at 11:56

Quick Joe Smith · Accepted Answer · 2011-02-09 11:59:26Z

2

ASP.NET sessions time out after 20 minutes by default, I think.

You can extend this by specifying a longer time (in minutes) in the Web.config:

<system.web>
    <sessionState timeout="60"/>
    ...
</system.web>

If you are authenticating via Forms, you should raise the authentication cookie timeout value to match.

Also bear in mind that, when running the site under IIS, you should probably extend the application pool's idle timout to something similar. If you don't do this, the HttpApplication instance for your ASP.NET site will be unloaded, destroying any active sessions in the process.

answered Feb 9, 2011 at 11:59

Quick Joe Smith

8,2783 gold badges32 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

chandrabhan singh Over a year ago

I have added <sessionState mode="InProc" cookieless="false" timeout="30"/>also I have set timeout="365" inside <authentication mode="Forms"> element in my webconfig. All is working fine but when I left session opened for more then 30 mins it dosent allow me to access those pages where I have set <deny users="" /> in location tag but when I tried with setting <deny users="?" /> it works fine.I need <deny users="" /> bcos it will restrict any user not having role to my folder.

Quick Joe Smith Over a year ago

Why are you expecting that sessions will somehow work beyond their timeout value?

chandrabhan singh Over a year ago

Joe first let me thank you for your quick reply that I forgot last time! well when my session times out, user redirected to login page if she clicks on any link(server request), after providing credintials I redirect her back to the page she was working on, by using Request.QueryString["ReturnUrl"]. but as she logis in again, she gets my custom-access denied page, even in new tab in same IE browser user is not able to access the page, she has to close the window! :-(

Mohammad Fahmawi · Accepted Answer · 2012-12-23 14:47:48Z

Usually, the first and easiest thing to do is just change the configuration/system.web/sessionState@timeout value to something like “90″

<sessionState timeout="90" />

it still appears to be timing out after 20 minutes. *This doesn’t make any sense, it explicitly says that the session timeout should be exactly 90 minutes.*

There’s a couple of issues that are tied together here:

The application pool’s worker process default idle timeout is also set to 20 minutes
The default mode of storing session state is in the IIS process

The settings for the application pool can be found by clicking Properties (IIS 6) or Advanced Settings (IIS 7.5) on the application pool that the application is assigned to.

Ensure the value of "Idle-Time-out(minutes)" is set to the timeout of your session, at a minimum (ex 90), to ensure that all sessions persist for the entire session timeout period.

try this solution if still there is a problem refer to this article it tell more option to try

http://asp-net.vexedlogic.com/2012/05/23/aspasp-net-session-timeout-how-do-i-change-it/

Collectives™ on Stack Overflow

ASP.NET Session TimeOut problem

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related