2

I'm using asp .NET MVC app, and I've configured

<system.web><sessionState mode="InProc" timeout="90" /></system.web>

but It looks like session still valid only 20 minutes instead of 90, why?

How can I make this effective instead of the 20 (default I suppose)

I've checked te idle time in the application pool, it was 20, is that the cause of the timout? If yes, how can I override this from config file?

clement
  • 4,204
  • 10
  • 65
  • 133
  • Hi Clement, no, the idle timeout in the app pool does not configure the session time out. It is used by IIS to shut down inactive worker processes – user449689 Oct 22 '15 at 14:25

2 Answers2

4

The configuration you are posting seems correct.

Try to check also your IIS configuration. From this TechNet link:

  1. Open IIS Manager and navigate to the level you want to manage.
  2. In Features View, double-click ASP.
  3. On the ASP page, under Services, expand Session Properties.
  4. In the Time-out field, enter a time-out value in the format hh:mm:ss. For example, enter 00:15:00 for 15 minutes.
  5. In the Actions pane, click Apply.

If you are using Form Authentication keep in mind that it uses his own timeout that can be set as follows:

<system.web>
    <authentication mode="Forms">
          <forms timeout="90"/>
    </authentication>

    <sessionState mode="InProc" timeout="90"  />
</system.web>
user449689
  • 3,142
  • 4
  • 19
  • 37
  • I've edited the idle in the app pool, and it seems work (I've tested it) – clement Oct 22 '15 at 15:12
  • It looks strange as the idle timeout for the app pool is used for another purpose. Refer to this: http://stackoverflow.com/questions/9707535/what-is-the-different-between-session-timeout-and-idle-timeout-in-iis – user449689 Oct 22 '15 at 15:20
  • with session set to 60 and app pool at 20, if user connects at 1.00 and then no activity, at 1.20, app pool recycle the pool and session are "cleaned", no? – clement Oct 23 '15 at 09:38
  • Exactly, after my last comment I realized how it works, but I forgot to amend the comment ;) – user449689 Oct 23 '15 at 14:12
3

Because IIS restart the pool (including sessions) each x minutes with no activity, configured by the idle timeout in the settings of the pool itself, in the case if user set 90 minutes of session in the app, if there is no activity, IIS can restart the pool before this 90 minutes ends. Example:

Session is 60 minutes configures in app.config after 30 minutes of idle, the pool recycle itself Only one person use the app

1.00pm: user connects, he navigates during 10 minutes and then do nothing on the page (for instacne fill a very large form without submitting, and without ajax calls. At this point, user has session "open" untill 1.00am + 10 minutes + 60 minutes configured = 2.10 am At 1.50 am, he tried to press submit button but it doesn't work because the app pool was recycling at 1.40 (1.10 + 30 min of idle) so user lost session.

If this is possible that user is anole on the app, idle time must be the same of greater than session time.

clement
  • 4,204
  • 10
  • 65
  • 133