0

We are having difficulty getting the Session Timeout to work in ASP.NET 4. We have the timeout set for 720 minutes(12 hours). We are using Forms Authentication. The timeout occurs after about 20 minutes regardless of what I set the timeout to. I'm sure we configured something wrong, but I'm not sure what. I've looked online at several fixes(headers, etc), but can't seem to get anything to work. Here is our config file:

<authentication mode="Forms">
     <forms loginUrl="~/Login.aspx" name="CAFormsAuth" timeout="720" slidingExpiration="true" defaultUrl="Default.aspx" /> </authentication> <authorization>    <!--<allow users="*"/>-->   <deny users="?" /> </authorization>

Here is our login code:

try
        {
            string adLogin = txtUserName.Text;

            bool isValid = false;
            //Validate User against AD First...
            //----------------------------------
            try
            {
                isValid = AuthenticateUser(cboDomains.Text, adLogin, txtPassword.Text);
            }
            catch (Exception ex)
            {
                //Should read "Invalid Username or Password"...
                //lblError.Text = ex.Message;
                lblError.Text = "Invalid User Name or Password.";
                return;                   
            }

            //Now, See if the user exists in the database.
            //---------------------------------------------
            db_users user = null;
            try
            {
                user = usrHelp.GetUserByADUserName(cboDomains.Text + @"\" + adLogin);

                if (user == null)
                {
                    lblError.Text = "User " + adLogin + " does not exist in the database.";
                    return;
                }
            }
            catch (Exception ex)
            {
                ErrorLoggingHelper.LogToSource(Globals.ApplicationName, ex.ToString(), System.Diagnostics.EventLogEntryType.Error);

                lblError.Text = "User " + adLogin + " does not exist in the database.";
                return;
            }

            if (isValid)
            {
                if (chkRemember.Checked)
                {
                    SetCookies();
                }
                else
                {
                    RemoveCookie();
                }
            }
            else
            {
                lblError.Text = "Password is not valid";
                Telerik.Web.UI.RadAjaxManager.GetCurrent(this.Page).ResponseScripts.Add(String.Format("SetFocus('{0}')", txtPassword.ClientID));
                return;
            }

            Session[Globals.LoggedInUserName] = txtUserName.Text;
            Session[Globals.LoggedInUserId] = user.user_id;
            Session["CurrentUser"] = user;

            FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);

        }
        catch (Exception ex)
        {
           //deleted error logging code here...
            lblError.Text = "Error authenticating user. Please contact the administrator.";
        }

2 Answers 2

2

There is an advanced setting within your IIS in the Application Pool level. There's an 'Idle Timeout' setting under 'Process Mode' which has the default setting of 20 min. You should be able to change it there.

Sign up to request clarification or add additional context in comments.

1 Comment

Good deal. Please accept as answer so that others may benefit from the Q&A.
0

Try setting the session timeout in your web.config like this:

<configuration>
  <system.web>
    <sessionState mode="InProc" timeout="720" />
  </system.web>
</configuration>

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.