How to set session timeout in web.config

598,948

Solution 1

If you want to set the timeout to 20 minutes, use something like this:

    <configuration>
      <system.web>
         <sessionState timeout="20"></sessionState>
      </system.web>
    </configuration>

Solution 2

The value you are setting in the timeout attribute is the one of the correct ways to set the session timeout value.

The timeout attribute specifies the number of minutes a session can be idle before it is abandoned. The default value for this attribute is 20.

By assigning a value of 1 to this attribute, you've set the session to be abandoned in 1 minute after its idle.

To test this, create a simple aspx page, and write this code in the Page_Load event,

Response.Write(Session.SessionID);

Open a browser and go to this page. A session id will be printed. Wait for a minute to pass, then hit refresh. The session id will change.

Now, if my guess is correct, you want to make your users log out as soon as the session times out. For doing this, you can rig up a login page which will verify the user credentials, and create a session variable like this -

Session["UserId"] = 1;

Now, you will have to perform a check on every page for this variable like this -

if(Session["UserId"] == null)
    Response.Redirect("login.aspx");

This is a bare-bones example of how this will work.

But, for making your production quality secure apps, use Roles & Membership classes provided by ASP.NET. They provide Forms-based authentication which is much more reliabletha the normal Session-based authentication you are trying to use.

Solution 3

If you are using MVC, you put this in the web.config file in the Root directory of the web application, not the web.config in the Views directory. It also needs to be IN the system.web node, not under like George2 stated in his question: "I wrote under system.web section in the web.config"

The timeout parameter value represents minutes.

There are other attributes that can be set in the sessionState element. You can find information here: docs.microsoft.com sessionState

<configuration>
   <system.web>
      <sessionState timeout="20"></sessionState>
   </system.web>
</configuration>

You can then catch the begining of a new session in the Global.asax file by adding the following method:

void Session_Start(object sender, EventArgs e)
{
    if (Session.IsNewSession)
    {
        //do things that need to happen
        //when a new session starts.
    }
}
Share:
598,948

Related videos on Youtube

George2
Author by

George2

Updated on February 08, 2020

Comments

  • George2
    George2 about 4 years

    I have tried very hard but cannot find a solution on how to set session timeout value for in-process session for an ASP.Net web application.

    I am using VSTS 2008 + .Net 3.5 + C#. Here is what I wrote by myself to set timeout to be 1 minute, is it correct?

    I wrote under system.web section in the web.config

    <sessionState timeout="1" mode="InProc" />
    
    • Darin Dimitrov
      Darin Dimitrov almost 15 years
      The way you define the timeout is correct. Do you have any issues with it?
    • Ivan Zlatanov
      Ivan Zlatanov almost 15 years
      You know that this means it will expire after 1 minute of inactivity, not after 1 minute from its start? My guess is that if you are asking this question, and have typed the timeout correctly, you might be mislead of how it works.
    • George2
      George2 almost 15 years
      I need to set inactive time, it is just what I need. Thanks Ivan!
    • Brian McCarthy
      Brian McCarthy over 12 years
      LOL! I wouldn't recommend setting the time-out to just 1 minute. That's gonna kill the useability!
    • Brett Weber
      Brett Weber over 9 years
      I completely understand the need for a short timeout period. In my case it is to test the usability of the site if the session does time out and how it reacts once the user comes back. It's hard to test that while also debugging unless the session timeout occurs quickly
    • Alex Angas
      Alex Angas almost 7 years
      Possible duplicate of Session timeout in ASP.NET
    • Josf
      Josf almost 5 years
      Does this change the 'Expires/ Max-Age' of 'ASP.NET_SessionId' cookie in chrome dev tools. ?
  • arcain
    arcain about 11 years
    You don't need most of the attributes you list, just timeout really. stateConnectionString and sqlConnectionString are ignored when mode="InProc", and the values for mode and cookieless are set to their default values. So, this really distills down to Wolfwyrd's answer.
  • Muhammad Awais
    Muhammad Awais almost 8 years
    20 minutes or hours? (timeout="20")
  • Wolfwyrd
    Wolfwyrd almost 8 years
    Config states the timeout in minutes so 20 minutes
  • Chris Catignani
    Chris Catignani about 6 years
    Great advice... Be sure to set a Session variable first before testing with Response.Write(Session.SessionID); other wise it will refresh with a new ID every time you refresh.