Setting session timeout in asp.net mvc4?

Question

In a nutshell, I want to show loginpage when the session expires.For that I have modified some details in web.config shown below so that I can test whether the logic works.But sadly the below logic is not firing

My expectation was to go the Login Action in the Account Controller when the session expires.

Also what's the difference between the timeout in authentication section and session state section

<authentication mode="Forms">     
  <forms loginUrl="~/Account/Login"  timeout="1" />
</authentication>

<sessionState mode="InProc" timeout="1" customProvider="DefaultSessionProvider">
  <providers>
    <add name="DefaultSessionProvider" type="System.Web.Providers.DefaultSessionStateProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" />
  </providers>
</sessionState>

They are documented

stuartd
– stuartd

2015-11-11 12:16:37 +00:00
Commented Nov 11, 2015 at 12:16 — stuartd
– stuartd, Commented Nov 11, 2015 at 12:16

user2771704 · Accepted Answer · 2015-11-11 13:07:52Z

1

You could implement this by using custom attribute like below:

public class SessionTimeOutAttribute : ActionFilterAttribute
    {
        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            HttpContext context = HttpContext.Current;

            // check if session supported
            if ( context.Session != null ) {
                if( context.Session["username"] == null ) {
                   context.Response.Redirect ( "~/Account/Login" );
                }
            }
            base.OnActionExecuting(filterContext);
        }
    }

Then you could apply this attribute to your Controllers or particular actions like this:

      [SessionTimeOut]
      public class HomeController : Controller
      {

      }

or for Action:

      [SessionTimeOut]
      public ActionResult Index()
      {
         return Index();
      }

answered Nov 11, 2015 at 13:07

user2771704

6,2526 gold badges41 silver badges43 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

forX Over a year ago

for global use GlobalFilters.Filters.Add(new SessionExpireFilterAttribute()) stackoverflow.com/questions/25423464/…

Community · Accepted Answer · 2017-05-23 11:51:57Z

According to this answer, the basic difference of these timeout properties is:

<authentication mode="Forms">     
  <forms loginUrl="~/Account/Login"  timeout="1" />
</authentication>

"The Forms Authentication Timeout value sets the amount of time in minutes that the authentication cookie is set to be valid"

<sessionState mode="InProc" timeout="1" customProvider="DefaultSessionProvider">
  <providers>
    <add name="DefaultSessionProvider" type="System.Web.Providers.DefaultSessionStateProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" />
  </providers>
</sessionState>

"The SessionState timeout value sets the amount of time a Session State provider is required to hold data in memory (or whatever backing store is being used, SQL Server, OutOfProc, etc) for a particular session."

Have you registered the Authorize filter in RegisterGlobalFilters ?

public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
    filters.Add(new AuthorizeAttribute());
}

And also configured your controllers with [Authorize] annotation ?

Collectives™ on Stack Overflow

Setting session timeout in asp.net mvc4?

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related