How to force a 20 minute time-out for sessions?

Question

I'm very confused when it comes to what actually decides the session time-out.

The web app needs to allow for a 20 minute "idle time" before logging (or throwing) users out. I've tried different setting on both sessionState and Recycle worker processes in IIS. The time-out remains too short and, as far as my quit-n-dirty, primitive tests have shown, a bit random.

I read somewhere that the default time-out is 20 minutes, but in my app it appears to be closer to five. Are there any easy ways to change this? The app is running .NET 3.5 on IIS 6.

EDIT: I just realized that the Entity Framework might have something to do with the problem, as the user content is held as a context in the entity framework. Is there any time limit for how long an entity is held?

Answer 1

The user will be logged out based on your Authentication settings in the web.config.

The Session timout will be set in your session tag in the web.config.

If they are different then you will see "interesting" results.

Answer 2

http://msdn.microsoft.com/en-us/library/ms972429.aspx

If you look in the web.config you can write some thing like this

<configuration>
  <sessionstate timeout="20" />
</configuration>

and there you can set you timeout..

Answer 3

Use the sessionstate timeout. You do not want to use Recycle Worker, as this will recycle all sessions associated with that worker, every N minutes. It's a good idea to set Recycle Worker to a very high value if you are using the session variable.

Answer 4

If the sesson it not taking its value from the web.congig you can also set the sasson timeouw within IIS

webste properties > Home Directory > Configuration > Options

Make sure enable sesson state is selected and then set the time out in mins.