What is the best approach to handle session timeouts in asp.net

Question

There are various ways to handle session timeouts, like "meta refreshes" javascript on load functions etc.

I would like something neat like: 5 minutes before timeout, warn the user...

I am also contemplating keeping the session open for as long as the browser is open(still need to figure out how to do it though... probably some iframe with refreshing).

How do you handle session timeouts, and what direction do you think i should go in?

Answer 1

The only thing I can think of is to generate some script on the page that creates a client timer, so that when the page is received and rendered, it can show an alert X-minutes later (that is 5mins before expire).

If you'd rather have the session just keep itself alive, you can do this with a generic handler (ASHX) that you periodically call via AJAX. This will help refresh the session and it should stay alive for as long as the AJAX calls continue.

Example "keepalive.ASHX":

<%@ WebHandler Language="C#" Class="keepalive" %>

using System;

public class keepalive : System.Web.IHttpHandler
{       
    public void ProcessRequest (System.Web.HttpContext context) 
    {
        context.Response.ContentType = "text/json";
        var thisUser = System.Web.Security.Membership.GetUser();

        if (thisUser != null)
            context.Response.Write("[{\"User\": \"" + thisUser.UserName + "\"}]");
    }

    public bool IsReusable
    {
        get { return false; }
    }
}

And here's the script on the page to call it (with jQuery for simplicity):

<script type='text/javascript'>
    function keepAliveInterval()
    {
        $.ajax(
        {
            url: "keepalive.ashx",
            context: document.body,
            error: function () {
                alert("AJAX keepalive.ashx error :(");
            }
        });
    }

    $(document).ready(function () {
        window.setInterval('keepAliveInterval()', 60000);
    });
</script>

Answer 2

The best approach to handle sessions timeouts.

I say that there is 2 basic cases.
One is when the users enter little or no data, and just read reports, or do small thinks with his mouse. In this case there is not easy way to inform him that the session is going to off, because maybe there is a second window-tab open and keeps the session alive, so the message is return false, or if you try to check him, you automatically update user sessions... so just let him expire, no big deal.

Second is when the user need to enter many data, that some time can take time, a long text for example, to write it and fix it. In this case I use the below technique and I am not let the session go out.

How to keep the session open as long as the browser.

Here is a very nice and simple technique, I use an image that I make an reload of it before the session is timeout using JavaScript.

<img id="keepAliveIMG" width="1" height="1" src="/img/ui/spacer.gif?" /> 

<script language="javascript" type="text/javascript"> 
    var myImg = document.getElementById("keepAliveIMG");

    if (myImg){
        window.setInterval(function(){
              myImg.src = myImg.src.replace(/\?.*$/, '?' + Math.random());
            }, 6000);
    }   
</script> 

Answer 3

Use some jquery that keys off of your session timeout variable in the web.config. You can use this Jquery delay trick that when a specific time occurs (x number of minutes after load of the page), it pops up a div stating session timeout in x minutes. Nice, clean and pretty simple.

Regarding session timeout, Codesleuth's ajax call would be perfect.