sql sessionState time out vs forms authentication timeout

Question

I would like to display the "Your session has expired" on logon page if session has been idle for given 5 minutes.

What should the time out value be for Sql Session State and Form Authentication Time Out:

same?

session state> form timeout

Form time out > session time.

ideally, if someone could explain the diff between above will be appreciated.

Currently, my code looks like below and Session["SessionID"] is not Null even after Login redirection for idle of 5 minute:

On Session_Start()
 Session["SessionID"] = Guid.NewGuid();

On LogOn.cshtml:

 @{
        string sessionExpiredMsg = string.Empty;

        HttpContext ctx = HttpContext.Current;
        if (ctx.Session["SessionID"] == null)
        {
            sessionExpiredMsg = "Your session has expired. Please re-login again.";
        }
    }
@

On web.config:

<sessionState
timeout=5....

<authentication mode="forms"
 timeout=5....

Thank you.

lnu · Accepted Answer · 2011-04-27 12:58:14Z

5

Session state timeout means that your asp.net session will expire in x minutes. It doesn't mean that your're not authenticated anymore.
Forms timeout means that after x minutes, you'll be prompted to log in again(not authenticated anymore).

It's not a problem if your sessionstate timeout lasts longer that your forms timeout because once you'll log in again you will retrieve the last one if not expired.

edited Apr 27, 2011 at 12:58

answered Apr 27, 2011 at 12:19

lnu

1,4141 gold badge9 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Nil Pun Over a year ago

Thanks lnu, i've updated my question with codes which is not working.

Nil Pun Over a year ago

ctx.Session["SessionID"] still contains the value even after login redirection. Not sure why.

lnu Over a year ago

have you seen this:blogs.msdn.com/b/nikhiln/archive/2007/06/21/…

Nil Pun Over a year ago

yep that is what I used, and doesn't work. Session is not null even redirection to Login page

lnu Over a year ago

Try to put 10 minutes for your forms timeout and 1 minute for your session. I've done the same as you and my session is empty( and Session.IsNew==true) after 1 minute. But it keeps the same sessionid.

Collectives™ on Stack Overflow

sql sessionState time out vs forms authentication timeout

1 Answer 1

5 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Related