CODEWITHSUNDEEP
asp.netsql-serverasp.net-mvcsession
Nirav Kamani
Nirav Kamani

Reputation: 3272

Session timeout is not working while using SqlServer mode

I am developing ASP.Net MVC application.

We have used sessionState mode SQLServer and i have set timeout to 20 minutes.

<sessionState mode="SQLServer" 
              sqlConnectionString="data source=127.0.0.1;user id=sa;password=sa" 
              cookieless="false" 
              timeout="2" />

Code is something like this in web config.

I have also set login page.

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="2880" />
</authentication>

Now when session expires i want to navigate user to login page.

I checked many things but i was unable to understand how it exactly works? and how can i navigate user login page on session expire?

It is working in InProc mode. I used it in same way and user is redirected to login on session expire.

But i am unable to accomplish same thing in SQLServer Mode.

I am unable to understand what i am missing?

I checked Session State and also found that Session timeout handled in SQLServer Mode

Edit :- I want to redirect user to login page whenever another http request is executed for that session.

Upvotes: 2

Views: 2400

Answers (3)

Pavel Sem
Pavel Sem

Reputation: 1753

Difference between InProc and SQLServer mode is that SQLServer relies on MSSQL job to remove the session. It actively doesn't prevent you from login again.

See Session State Providers

SqlSessionStateStore doesn't actively monitor the Expires field. Instead, it relies on an external agent to scavenge the database and delete expired sessions—sessions whose Expires field holds a date and time less than the current date and time. The ASPState database includes a SQL Server Agent job that periodically (by default, every 60 seconds) calls the stored procedure DeleteExpiredSessions to remove expired sessions.

Upvotes: 0

Ninos
Ninos

Reputation: 229

For me, changing the timeout value in the web.config file to anything didn't take place, and the reason was there were somehow some leftover old records in the ASPStateTempSessions table in ASPState database. I had to empty the table and only then my web.config changes took place. I wasted an hour trying to search for the cause so hope this helps someone.

So, run this:

delete from ASPStateTempSessions

Upvotes: 0

John Wu
John Wu

Reputation: 52240

Ordinarily the browser has no idea what is going on on the server. Unless an HTTP round trip occurs, it will remember the state of the session from when the page was rendered.

In addition, you session cookie is probably HttpOnly, so there is no way for the page to check for the presence of a session cookie.

One way to accomplish what you want is:

  1. Add a hidden iFrame to your page. Set the SRC of the iFrame to a handler in your web site

  2. The handler doesn't have to do much except return a 200 OK, plus a refresh header set to a few seconds, so that the handler gets continually polled.

    context.Response.AddHeader("REFRESH", "2");

  3. Add framebreaker code to your login page

     if (top.location != location) {
    top.location.href = document.location.href ;
 }

  4. When a request for the handler occurs with an expired session, it'll get redirected to the login page via forms authentication; when the login page is returned, it'll break your iFrame and redirect the full window to the login page.

Or, you can do what everyone else does, which is wait for the user to request another page.

Upvotes: 1

Related Questions