timeout and session timeout issue

Question

I have a problem with timeout.

firstly the timeout happens every 20 minutes on server even if the time in webconfig is set to 120 mins.

second, when the timeout happens it goes to the login page, which is correct but on logging back in it sometimes goes to the default page and sometimes to the page it was previously on. I want it to go to the default page everytime. Like it should remove all the sessions and cookies if thats the problem.

<authentication mode="Forms">
 <forms loginUrl="Login.aspx" defaultUrl="~/Default.aspx" name="GUI"   slidingExpiration="true" timeout="120" path="/">
</forms>
</authentication>
 <authorization>
 <deny users="?"/>
    <allow users="*"/>
 </authorization>

<sessionState mode="InProc" cookieless="false" timeout="120"/>

This is what is there in my webconfig.

Thanks..

Answer 1

Check the following things:

• You've definitely got 120 mins in your web.config?
• Is this your only web.config? If not is it picking these values up from the correct place?
• Use fiddler (or similar) to check your browser is still requesting with a cookie (especially after 20 mins)

Other than that I have no suggestions, parhaps your 64% accept rate is putting people off.

Answer 2

My understanding is that with the setup you described ASP.NET doesn't allow unauthenticated web access to your site. This means that when you go to WebForm1.aspx you get redirected to the login page with this url

/login.aspx?ReturnUrl=%2fWebForm1.aspx

Then in your login page you might have something like this

    protected void LoginButton_Click(object sender, EventArgs e)
    {

        if (FormsAuthentication.Authenticate(UsernameTextbox.Text, PasswordTextbox.Text))
            FormsAuthentication.RedirectFromLoginPage(UsernameTextbox.Text,false);
        else
           // Let the user know they didn't authenticate

   }

This redirects back to whatever the ReturnUrl specifies.

Well if you don't want that to happen don't do that. Do something like this instead.

    protected void LoginButton_Click(object sender, EventArgs e)
    {

        if (FormsAuthentication.Authenticate(UsernameTextbox.Text, PasswordTextbox.Text))
            Response.Redirect("default.aspx");
        else
           // Let the user know they didn't authenticate

    }

Answer 3

This may or may not be related to your specific issue, but in-proc user sessions will not survive application recycles. Check in IIS that your application recycle time is sufficiently high. Your sessions may indeed last 120 minutes if the application remains active, but once it idles for too long, your app will recycle and your user sessions will become invalidated.

Answer 4

Hi Take a look at the application pool in iis, check the advanced settings->process model->idle timeout (minutes). Set this higher than 20 mins. Sounds like the worker process is shutting down because its idle. Often this happens with test systems because they don't get that many hits to stop the idle timeout from kicking in.

Cheers Tigger