Niraj Bhatt – Architect's Blog

Ruminations on .NET, Architecture & Design

ASP.NET Session Timeout Not Working

Many of us are familiar with ASP.NET session state and various options surrounding it. Applications are either aggressive or relaxed about their session timeline and in most cases you would be inclined to change the default session timeout limit of 20 minutes. The obvious place to do this in web.config’s sessionState element as shown below:


<sessionState timeout=”40″ /> <!–timeout is in minutes–>

But unfortunately there are caveats to it. In case you are using forms authentication there is a timeout for the underlying forms authentication cookie. The default value of this timeout is 30 minutes and hence you might witness user being thrown out of the system before his session expires. Hence you want to ensure that the cookie lifetime matches the session time.

<authentication mode=”Forms”>
<forms loginUrl=”~/Login.aspx” timeout=”40″ /> <!–timeout is in minutes–>

Finally you might also want to check your Application Pool’s idle timeout. If there is sole user browsing your site (could be rare case) and user idle time exceeds the application pool idle time, you might again see an unexpected behavior. So ensure application pool idle timeout too matches your session timeout.

Hope this helps!!!


8 responses to “ASP.NET Session Timeout Not Working

  1. VINod Bheemisetty November 10, 2011 at 12:24 pm

    I didn’t find Advanced settings in VS2010

  2. nirajrules February 4, 2012 at 12:51 pm

    Advance Settings are from IIS 7. Sorry for the confusion.

  3. Sinai Londhe June 28, 2012 at 4:46 pm

    thanks it really helped 🙂

  4. Vaishali Bhajbhuje October 14, 2015 at 12:22 pm

    I used Parrel Plask for web hosting so where i set Application Pool’s idle timeout

  5. bagavath February 22, 2016 at 12:09 pm

    i can see only General and Behaviour options in Advanced settings.

  6. Hardeep March 23, 2016 at 5:41 pm

    Any way, to do settings of Idle timeout for particular website?

  7. nirajrules April 12, 2016 at 1:46 am

    Hardeep, I guess you can always create multiple application pools, to the point of just having 1:1 mapping.

  8. nirajrules April 12, 2016 at 2:00 am

    @bagavath, I installed IIS after long time just for you :). Setting is still there – are you checking it under app pool?

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: