Programmatically refreshing session timeout in ASP.NET MVC4 application

Question

In a nutshell, we want our sessions to last a business day and timeout in the evening. Currently I've set up some simple logic in Session_Start to set the timeout to the number of minutes left until 6pm.

My issue is on refresh the timeout gets set back to that value, so if you login at 8am your session will keep refreshing to 10 hours.

Is there any way to override the default logic for refreshing sessions to only set it to X if there is less than X remaining? So like if it gets under 20 minutes remaining I set it back to 20 minutes, but otherwise leave it alone?

Thanks for reading!

It seems like you have sliding expiration, and want absolute expiration. I know this is easy with Cache items but I am not sure about Sessions. I'll look. — Zerkey
– Zerkey, Commented Oct 9, 2013 at 18:31
I was looking at that too, but at some point I do want to extend it. If someone is working late I don't want their session to expire every 20 minutes. — GoodGuyJim
– GoodGuyJim, Commented Oct 9, 2013 at 20:55

Zerkey · Accepted Answer · 2013-10-09 21:25:33Z

2

Your timeout is set in global.asax only on Session_Start, so if a user logs in at 8am, the timeout would be set to 10 hours. If they access your site again within that time frame, their session is extended another 10 hours, because the logic in Session_Start does not fire again.

Solution 1 can offer is based off this article. Basically you add every new Session by reference to a List. At 6pm you could iterate through this list and Session.Abandon() any open Sessions. This would let you keep all your timeout logic in one or two files.

You can also put a method in your Page_Load() that gets the current time and adjusts the Session.Timeout property. Here is an example:

protected void Page_Load(object sender, EventArgs e)
{
    int timeout = 20;

    var hr = DateTime.Now.Hour;
    var min = DateTime.Now.Minute;
    var time = (hr * 60) + min;

    //1080 minutes = 6pm

    if (time <= 1080)
    {
        timeout = 1080 - time;
    }

    if (time > 1080)
    {
        //1440 minutes = midnight
        timeout = (1440 - time) + 1080;
    }

    Session.Timeout = timeout;

}

The code above will expire all sessions at 6pm server time. Try to put this on a master page if you have one.

edited Oct 9, 2013 at 21:25

answered Oct 9, 2013 at 18:54

Zerkey

7951 gold badge6 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

GoodGuyJim Over a year ago

"Okay, So if a user logs in at 8am, the timeout would be set to 10 hours. If they access your site again within that time frame, their session is extended another 10 hours." Yep that's exactly what I'm trying to avoid, which is why I don't want to refresh it unless it goes under 20 minutes. Thanks for the suggestion, I will look into it

Zerkey Over a year ago

You're welcome. I expanded my answer a bit and added some code, check it out.

GoodGuyJim Over a year ago

I'm using MVC so I don't have a Page_Load event. The closest thing would be overriding virtual methods from System.Web.MVC.Controller, but I don't know which one refreshes the timeout, was hoping someone did.

Manuel · Accepted Answer · 2013-12-02 07:42:04Z

0

protected void Page_Load(object sender, EventArgs e)
{
  int timeout = 20;
  var hour = DataTime.Now.Hour;
  var minutes =DataTime.Now.Minutes;
  var time = (hour * 60) + minutes;
  if (time <= 2000)
  {
    timeout = 2000 - time;
  }
  if (time > 2000)
  {
    //3000 minutes = midnight
    timeout = (3000 - time) + 2000;
  }
  Session.Timeout = timeout;
}

edited Dec 2, 2013 at 7:42

Manuel

4,4536 gold badges38 silver badges52 bronze badges

answered Dec 2, 2013 at 7:11

sree

1

Collectives™ on Stack Overflow

Programmatically refreshing session timeout in ASP.NET MVC4 application

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related