Session timeout in ASP.NET

Question

I am running an ASP.NET 2.0 application in IIS 6.0. I want session timeout to be 60 minutes rather than the default 20 minutes. I have done the following

Set <sessionState timeout="60"></sessionState> in web.config.
Set session timeout to 60 minutes in IIS manager/Web site properties/ASP.NET configuration settings.
Set idle timeout to 60 minutes in application pool properties/performance.

I am still getting a session timeout at 20 minutes. Is there anything else I need to do?

Please provide information on how you measured the 20 minutes. Let's be sure that the 20 minutes is a Session timeout, and not some other kind. — John Saunders, Mar 16 '09 at 01:54
Please mark quality answers as accepted by using the checkmark near the upvote/downvote arrows — Brian Webster, Jan 18 '13 at 01:59
Please clarify what you mean by IIS manager/Web site properties/ASP.NET configuration settings. Step by step what did you change in IIS? — niico, Jan 30 '19 at 12:13

score 300 · Answer 1 · answered Mar 16 '09 at 12:04

Are you using Forms authentication?

Forms authentication uses it own value for timeout (30 min. by default). A forms authentication timeout will send the user to the login page with the session still active. This may look like the behavior your app gives when session times out making it easy to confuse one with the other.

<system.web>
    <authentication mode="Forms">
          <forms timeout="50"/>
    </authentication>

    <sessionState timeout="60"  />
</system.web>

Setting the forms timeout to something less than the session timeout can give the user a window in which to log back in without losing any session data.

score 50 · Answer 2 · edited Nov 14 '17 at 15:22

50

I don't know about web.config or IIS. But I believe that from C# code you can do it like

Session.Timeout = 60; // 60 is number of minutes

edited Nov 14 '17 at 15:22

Mawardy

3,618
2
33
37

answered Mar 16 '09 at 02:11

Dmitris

3,408
5
35
41

26

Will this only adjust the timeout of the current session? Or will this adjust the timeout for the whole application? – Johncl Aug 27 '12 at 07:32
2

Nothing in the [documentation](https://msdn.microsoft.com/en-us/library/system.web.sessionstate.httpsessionstate.timeout%28v=vs.110%29.aspx) indicates that setting `Session.Timeout` is any different than using web.config or IIS, so I assume it is for the whole application. – Drasive Jul 28 '15 at 10:20
I think @Drasive has right, but it must be proved at least by 2 separated connected client to server and check Idle session timeout. – QMaster Mar 28 '17 at 11:53

score 44 · Answer 3 · edited Mar 20 '15 at 15:08

44

Use the following code block in your web.config file. Here default session time out is 80 mins.

<system.web>
 <sessionState mode="InProc" cookieless="false" timeout="80" />
</system.web>

Use the following link for Session Timeout with popup alert message.

Session Timeout Example

FYI:The above examples is done with devexpress popup control so you need to customize/replace devexpress popup control with normal popup control. If your using devexpress no need to customize

edited Mar 20 '15 at 15:08

Charles Caldwell

16,649
4
40
47

answered Dec 14 '11 at 07:04

Rama Subba Reddy M

687
7
14

cookieless false ? – Kiquenet Dec 07 '18 at 08:08
6

@Kiquenet, if you set cookieless to true then your sessionId will be embedded in URL which is a high security risk. ASP.NET framework inserts a unique id to the URL, you can check this by disabling the cookie or by setting the cookieless attribute to true as you did. According to MSDN, By default, the SessionID value is stored in a non-expiring session cookie in the browser but if you specify cookieless="true" then ASP.NET maintains cookieless session state by automatically inserting a unique session ID into the page's URL. – Hamza Khanzada Aug 28 '19 at 11:00

score 21 · Answer 4 · answered Oct 23 '13 at 11:01

21

In my situation, it was Application Pool. It is set to restart when idle for xx mins. When I set it to not restart, it seems to use value from Web Config.

answered Oct 23 '13 at 11:01

lyords

261
3
2

5

I know we are 2020 but damn this just solved my issue thanks ! – Binary9 Jun 25 '20 at 09:22
@Binary9 Same here. Trying to work with some legacy stuff and can't find all the session timeout causes. – Matthew Allen Oct 26 '21 at 13:50
Can you say which setting in the Application Pool need to be changed? – LairdPleng Mar 07 '22 at 05:40
https://www.coreblox.com/blog/2014/12/iis7-application-pool-recycling-and-idle-time-out has further details for anybody else wanting to find directions to the appropriate setting – LairdPleng May 11 '22 at 05:53
App pool, advanced settings, process model, "Idle Time-out (minutes)" default of 20, can be set to 0 "forever"... – François Breton Aug 23 '22 at 20:34

score 9 · Answer 5 · answered Mar 16 '09 at 03:20

Do you have anything in machine.config that might be taking effect? Setting the session timeout in web.config should override any settings in IIS or machine.config, however, if you have a web.config file somewhere in a subfolder in your application, that setting will override the one in the root of your application.

Also, if I remember correctly, the timeout in IIS only affects .asp pages, not .aspx. Are you sure your session code in web.config is correct? It should look something like:

<sessionState
    mode="InProc"
    stateConnectionString="tcpip=127.0.0.1:42424"
    stateNetworkTimeout="60"
    sqlConnectionString="data source=127.0.0.1;Integrated Security=SSPI"
    cookieless="false"
    timeout="60"
/>

score 8 · Answer 6 · edited Jul 04 '15 at 19:03

That is usually all that you need to do...

Are you sure that after 20 minutes, the reason that the session is being lost is from being idle though...

There are many reasons as to why the session might be cleared. You can enable event logging for IIS and can then use the event viewer to see reasons why the session was cleared...you might find that it is for other reasons perhaps?

You can also read the documentation for event messages and the associated table of events.

score 4 · Answer 7 · answered May 26 '16 at 08:38

Since ASP.Net core 1.0 (vNext or whatever name is used for it) sessions are implemented differently. I changed the session timeout value in Startup.cs, void ConfigureServices using:

services.AddSession(options => options.IdleTimeout = TimeSpan.FromSeconds(42));

Or if you want to use the appsettings.json file, you can do something like:

// Appsettings.json
"SessionOptions": {
    "IdleTimeout": "00:30:00"
}

// Startup.cs
services.AddSession(options => options.IdleTimeout = TimeSpan.Parse(Config.GetSection("SessionOptions")["IdleTimeout"]));

score 4 · Answer 8 · answered May 29 '17 at 20:55

4

https://usefulaspandcsharp.wordpress.com/tag/session-timeout/

<authentication mode="Forms">
  <forms loginUrl="Login.aspx" name=".ASPXFORMSAUTH" timeout="60" slidingExpiration="true" />
</authentication>

<sessionState mode="InProc" timeout="60" />

answered May 29 '17 at 20:55

Paulo Tolentino

51
1

score 3 · Answer 9 · edited Dec 02 '15 at 14:35

3

If you are using Authentication, I recommend adding the following in web.config file.

In my case, users are redirected to the login page upon timing out:

<authentication mode="Forms">
    <forms defaultUrl="Login.aspx" timeout="120"/>
</authentication>

edited Dec 02 '15 at 14:35

Dan

533
2
6
21

answered Mar 19 '13 at 19:52

amar beeharry panray

41
2

I got error at here after i place it in web.config – Lst Patrick Aug 10 '15 at 09:45
This answer refers to the duration of the authentication cookie's timeout and is nothing to do with session timeout. – Philip Stratford Oct 27 '22 at 09:14

Christian Findlay · Answer 10 · 2017-02-22T23:33:40.843

3

You can find the setting here in IIS:

It can be found at the server level, web site level, or app level under "ASP".

I think you can set it at the web.config level here. Please confirm this for yourself.

<configuration>
   <system.web>

      <!-- Session Timeout in Minutes (Also in Global.asax) -->
       <sessionState timeout="1440"/>

   </system.web>
</configuration>

edited Feb 22 '17 at 23:33

answered Feb 22 '17 at 23:11

Christian Findlay

6,770
5
51
103

Also in Global.asax ? – Kiquenet Dec 07 '18 at 08:06

score 3 · Answer 11 · answered Dec 10 '19 at 13:24

The default session timeout is defined into IIS to 20 minutes

Follow the procedures below for each site hosted on the IIS 8.5 web

Open the IIS 8.5 Manager.

Click the site name.

Select "Configuration Editor" under the "Management" section.

From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState".

Set the "timeout" to "00:20:00 or less”, using the lowest value possible depending upon the application. Acceptable values are 5 minutes for high-value applications, 10 minutes for medium-value applications, and 20 minutes for low-value applications.

In the "Actions" pane, click "Apply".

score 0 · Answer 12 · answered Feb 29 '16 at 13:09

0

if you are want session timeout for website than remove

<authentication mode="Forms">
      <forms timeout="50"/>
</authentication>

tag from web.config file.

answered Feb 29 '16 at 13:09

Nayan Hodar

508
7
12

This answer refers to the duration of the authentication cookie's timeout and is nothing to do with session timeout. – Philip Stratford Oct 27 '22 at 09:14

score 0 · Answer 13 · answered Sep 18 '16 at 13:26

The Timeout property specifies the time-out period assigned to the Session object for the application, in minutes. If the user does not refresh or request a page within the time-out period, the session ends.

IIS 6.0: The minimum allowed value is 1 minute and the maximum is 1440 minutes.

Session.Timeout = 600;

score 0 · Answer 14 · answered Jan 26 '17 at 19:28

0

IIS sessions timeout value is for classic .asp applications only, this is controlled on IIS configuration. In your case For ASP.NET apps, only the web.config-specified timeout value applies.

answered Jan 26 '17 at 19:28

CREM

1,929
1
25
35

2

What about IIS's app pool timeout? – SteveCav Feb 08 '19 at 00:36

score -2 · Answer 15 · answered Dec 08 '10 at 05:53

-2

After changing the session timeout value in IIS, Kindly restart the IIS. To achieve this go to command prompt. Type IISRESET and press enter.

answered Dec 08 '10 at 05:53

Varun R

5
1

Editing the web.config file automatically causes IIS to reset. – Timothy Gonzalez Feb 24 '17 at 22:37

Session timeout in ASP.NET

15 Answers15

Linked

Related