asp.net mvc session timeout

Question

How to implement a session timeout feature for an asp.net mvc application? I want user to be automatically signed out once inactivity is detected for a give time period.

I can implement an ActionFilterAttribute and apply to each method but that would not automatically sign out the user. It will sign out only when user tried to invoke the method for that action.

Thanks.

Solution 1

That is so because session is maintained on server side. if u want that an idle page in user's browser be signed out automatically, you have to write some javascript for it. you can use ajax request to check if session is expired or not and depending upon the result you can redirect the user to index (login or any other page that does not require authentication)

Solution 2

You ought to be able to manage this from the web.config:

<system.web>
    <sessionState timeout="x"/> 
    ...
</system.web>

I'm no MVC expert, but a change in this behaviour rolled out across ASP.NET is not something I'd expect.

This can also be configured using the IIS management application; not certain which version of IIS you're using, but this Technet article describes what should be easy to follow even in older (pre-IIS7) versions. Note that behind the scenes this method still manages the settings within the web.config file, so if this is version-controlled I wouldn't recommend changing it in this manner.