CODEWITHSUNDEEP
asp.netformssessionauthentication
mark baer
mark baer

Reputation: 21

Session Timeout not working ASP.NET 4

We are having difficulty getting the Session Timeout to work in ASP.NET 4. We have the timeout set for 720 minutes(12 hours). We are using Forms Authentication. The timeout occurs after about 20 minutes regardless of what I set the timeout to. I'm sure we configured something wrong, but I'm not sure what. I've looked online at several fixes(headers, etc), but can't seem to get anything to work. Here is our config file:

<authentication mode="Forms">
     <forms loginUrl="~/Login.aspx" name="CAFormsAuth" timeout="720" slidingExpiration="true" defaultUrl="Default.aspx" /> </authentication> <authorization>    <!--<allow users="*"/>-->   <deny users="?" /> </authorization>

Here is our login code:

try
        {
            string adLogin = txtUserName.Text;

            bool isValid = false;
            //Validate User against AD First...
            //----------------------------------
            try
            {
                isValid = AuthenticateUser(cboDomains.Text, adLogin, txtPassword.Text);
            }
            catch (Exception ex)
            {
                //Should read "Invalid Username or Password"...
                //lblError.Text = ex.Message;
                lblError.Text = "Invalid User Name or Password.";
                return;                   
            }

            //Now, See if the user exists in the database.
            //---------------------------------------------
            db_users user = null;
            try
            {
                user = usrHelp.GetUserByADUserName(cboDomains.Text + @"\" + adLogin);

                if (user == null)
                {
                    lblError.Text = "User " + adLogin + " does not exist in the database.";
                    return;
                }
            }
            catch (Exception ex)
            {
                ErrorLoggingHelper.LogToSource(Globals.ApplicationName, ex.ToString(), System.Diagnostics.EventLogEntryType.Error);

                lblError.Text = "User " + adLogin + " does not exist in the database.";
                return;
            }

            if (isValid)
            {
                if (chkRemember.Checked)
                {
                    SetCookies();
                }
                else
                {
                    RemoveCookie();
                }
            }
            else
            {
                lblError.Text = "Password is not valid";
                Telerik.Web.UI.RadAjaxManager.GetCurrent(this.Page).ResponseScripts.Add(String.Format("SetFocus('{0}')", txtPassword.ClientID));
                return;
            }

            Session[Globals.LoggedInUserName] = txtUserName.Text;
            Session[Globals.LoggedInUserId] = user.user_id;
            Session["CurrentUser"] = user;

            FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);

        }
        catch (Exception ex)
        {
           //deleted error logging code here...
            lblError.Text = "Error authenticating user. Please contact the administrator.";
        }

Upvotes: 0

Views: 3703

Answers (2)

Bazinga
Bazinga

Reputation: 1014

There is an advanced setting within your IIS in the Application Pool level. There's an 'Idle Timeout' setting under 'Process Mode' which has the default setting of 20 min. You should be able to change it there.

Upvotes: 2

Eric J.
Eric J.

Reputation: 150228

Try setting the session timeout in your web.config like this:

<configuration>
  <system.web>
    <sessionState mode="InProc" timeout="720" />
  </system.web>
</configuration>

Upvotes: 0

Related Questions