Authentication session expires on ASP.NET MVC

Question

I want to log a user into an ASP.NET MVC site, and the session expires very quickly, in minutes. Authentication is done in one line of code:

authProvider.Authenticate(model.UserName, model.Password)

Then I have in Web.config:

<authentication mode="Forms">
<forms loginUrl="~/Account/Login" name=".ASPXAUTH" timeout="300" slidingExpiration="true">

and the setting on the IIS on the server for 300 minutes.

What is the problem?

Isn't it because your sessionState timeout has a low value? — krlzlx
– krlzlx, Commented Feb 16, 2017 at 16:28
those are minutes. so it should expire in 300 minutes, but it expires in 5. — Nicoara Talpes
– Nicoara Talpes, Commented Feb 16, 2017 at 17:01
I'm not talking about the forms timeout but the sessionState timeout — krlzlx
– krlzlx, Commented Feb 16, 2017 at 17:10
What value do you have in the Idle Time-out parameter or your Application Pool? Please refer to this article and this question. — krlzlx
– krlzlx, Commented Feb 17, 2017 at 15:35
@krlzlx you are correct! the value was 5 and now changing it to 300 saves the session. This is an amazing answer that I feel must be rewarded, if you would like to answer the question. thank you! — Nicoara Talpes
– Nicoara Talpes, Commented Feb 17, 2017 at 22:20

krlzlx · Accepted Answer · 2017-02-18 00:00:55Z

2

Make sure you have a sessionState timeout value that matches your forms timeout:

<system.web>
    <authentication mode="Forms">
      <forms loginUrl="~/Account/Login" 
         name=".ASPXAUTH"
         timeout="300"
         slidingExpiration="true" />
    </authentication>
    <sessionState timeout="300" mode="InProc" />
</system.web>

You also need to change the Idle Time-out parameter of your Application Pool to the desired authentification timeout to avoid the Application Pool to recycle too soon and therefore lose your sessions.

This parameter can be found in:

IIS - Application Pools - Advanced Settings of the Application Pool in question.

References:

If you don't want to change this parameter(*), a solution is to use the StateServer mode of the Session State. This mode uses a service to store the session instead of the memory with In-Process mode. It has the advantage of not losing the session when the Application Pool is recycled. It's also very easy to configure:

<system.web>
    <sessionState mode="StateServer"
       stateConnectionString="tcpip=loopback:42424"
       cookieless="false"
       timeout="300" />
</system.web>

(*) 5 minutes is very low. The default is 20 minutes. So I advice to set it to at least the default value if using the StateServer mode.

Reference:

Session-State Modes

edited Feb 18, 2017 at 0:00

answered Feb 17, 2017 at 23:51

krlzlx

5,83114 gold badges51 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Nicoara Talpes Over a year ago

Hello, so this worked for two months. now it doesn't any more. I see there are two cookies set , one Cookies/.ASPXAUTH (expires "When the browsing session ends") and another in Local Storage / name of my website (subdomain.domain.com, but does not have any associated metadata with it? ) . what do you advise?

krlzlx Over a year ago

I advise you to try the StateServer mode of the Session State like described in the second part of my answer.

Nicoara Talpes Over a year ago

Right, I overlooked that. I have now added both and I still lose the session in around 15 minutes. Should the text inside stateConnectionString be different than "tcpip=loopback:42424"?

krlzlx Over a year ago

No, that setting should work. Did you set the timeout to 300? You can check this setting in IIS -> YourSite -> Session State -> Cookie Settings - Time-out (in minutes) should be 300.

Nicoara Talpes Over a year ago

Yes it is my webconfig is: <authentication mode="Forms"> <forms loginUrl="~/Account/Login" name=".ASPXAUTH" timeout="300" slidingExpiration="true"> <credentials passwordFormat="Clear"> <user name="1" password="1" /> </credentials> </forms> </authentication> <sessionState mode="StateServer" stateConnectionString="tcpip=loopback:42424" cookieless="false" timeout="300" /> <pages> I publish with: - delete all existing files - precompile during publish - exclude files from App_Data folder

Collectives™ on Stack Overflow

Authentication session expires on ASP.NET MVC

1 Answer 1

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related