Proper session timeout

[No One]

I have a web app that uses forms authentication. When sessions timeout,
the user is not automatically redirected to the login page. Instead,
they see an error message about object references not being set. These
errors occur in the C# code behind. I also have to manually redirect
users that are not logged in. Does ASP.Net support sessions properly
out of the box (I have the web.config set to use forms authentication)
or do I have to role my own Session checking scheme to get users to the
login page?

 

[No One]

I have a web app that uses forms authentication. When sessions timeout,
the user is not automatically redirected to the login page. Instead,
they see an error message about object references not being set. These
errors occur in the C# code behind. I also have to manually redirect
users that are not logged in. Does ASP.Net support sessions properly
out of the box (I have the web.config set to use forms authentication)
or do I have to role my own Session checking scheme to get users to the
login page?

The interesting parts of my web.config file:

<authentication mode="Forms">
<forms name=".LoginForm" loginUrl="Login.aspx"
protection="All" timeout="30"/>
</authentication>

<machineKey validationKey="AutoGenerate"
decryptionKey="AutoGenerate" validation="SHA1"/>

<authorization>
<allow users="*"/>
</authorization>

 

[Patrick Olurotimi Ige]

If u check ur Web.Config..U will notice u have 20 minutes session
timeout my default!!
Try posting ur Web.config ..

Your Authentication element should like this and unauthenticated users
are suppose to be redirected to this page
<authentication mode="Forms">
<forms loginUrl="logon.aspx" name="adAuthCookie" timeout="2"
path="/" protection="All">
</forms>
</authentication>

Hope this helps.
Patrick

 

[Daniel Ansari]

The <forms> element in <authentication> section has a timeout attribute -
this is actually the timeout for the authentication ticket, and it sounds
like this is the one you've got set.

The session has a separate timeout specified in the <sessionState> element
in <system.web>.

This thing had me stumped for a long time.

Regards,
Daniel

 

[No One]

I have that too.

<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes"
cookieless="false" timeout="20"/>

 

[Daniel Ansari]

Have you tried setting the session timeout in IIS too?