Session timeout does not work at asp.net mvc 4 C# . Why?

Question

For my web site I configured login session timeout for 1 week in web.config file

<system.web>
  <httpRuntime />

  <!-- Session keeps for 7 days -->
    <sessionState timeout="10080"></sessionState>
    <authentication mode="Forms">
      <forms loginUrl="~/" timeout="10080" slidingExpiration="true"/>
    </authentication>
  <!-- Configuration end  -->
</system.web>

Here is code for login

    [AllowAnonymous]
    [HttpPost]
    public ActionResult Login(string Login, string Password)
    {
        // empty passwords are not allowed
        if (Password == "")
            return Redirect(Request.UrlReferrer.ToString());

        bool LoginResult = WebSecurity.Login(Login, Password, true);
        return Redirect(Request.UrlReferrer.ToString());
    }

I login, close browser and open it again go to my web site -> user is logged in. I close browser, wait some time (about 30 minutes) go to my web site -> user is logged off. Why? Session should be stored for 7 days but we does not have even 30 minutes. Whan can be the source of problem?

Edit 1 The main idea is that I want to go back to the site in several days and still open it with logged in user

Are you really sure you want to keep data in memory for 7 days after the last visit? — Hans Keﬆing
– Hans Keﬆing, Commented Apr 2, 2014 at 11:37
Yes, it is internal web site which has 3 users only and I'm tired to enter credentials every time — Vitalii
– Vitalii, Commented Apr 2, 2014 at 12:08
@Vitalii could you please let me know what configuration do we need to change. I'm on the same page. — Light
– Light, Commented Jun 21, 2019 at 9:17

SoftSan · Accepted Answer · 2014-12-17 10:35:49Z

12

Possibly, your IIS would have been configured to 20 minutes of TimeOut.

Change the IIS session timeout to ~~1 week~~ 24 hours, which I hope will solve your problem.

Refer this

By design, the maximum value of timeout is set to be 24 hours. Check out Microsoft support forum

To achieve a larger window for timeout, you could consider maintaining session states in SQL, as suggested by @Marc.

edited Dec 17, 2014 at 10:35

SoftSan

2,4723 gold badges25 silver badges56 bronze badges

answered Apr 2, 2014 at 11:31

LakshmiNarayanan

1,1889 silver badges12 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Vitalii Over a year ago

I found this value but another problem appeared. I cannot set more than 23:59 hours there. And I need at least several.

Marc · Accepted Answer · 2014-04-02 12:30:31Z

4

Try moving your session state into Sql (link here). This should persist an IIS restart/app pool recycle etc.

answered Apr 2, 2014 at 12:30

Marc

1,0101 gold badge10 silver badges18 bronze badges

Comments

Ramy Farag · Accepted Answer · 2016-04-17 15:49:20Z

3

Website Session.Timeout will work only when it is less than the application pool session timeout value; because whenever the application pool session timeout value is reached, that particular application pool will be restarted.

http://www.codeproject.com/Articles/113287/Why-Session-Timeout-is-not-working-for-your-websit

answered Apr 17, 2016 at 15:49

Ramy Farag

335 bronze badges

Comments

SoftSan · Accepted Answer · 2014-12-17 10:55:49Z

1

When the application is idle (no requests for some time), IIS may shut it down. This will destroy all Sessions.

Authentication stores it's data in a database and thus survives a restart.

edited Dec 17, 2014 at 10:55

SoftSan

2,4723 gold badges25 silver badges56 bronze badges

answered Apr 2, 2014 at 11:35

Hans Keﬆing

39.5k10 gold badges84 silver badges119 bronze badges

Collectives™ on Stack Overflow

Session timeout does not work at asp.net mvc 4 C# . Why?

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related