Security issue / Session variable expiration?

[VB Programmer]

I know you can make cookies expire, but how about session variables? I'm
basically using session for security, etc... One variable is
session("LoggedOn"). If a page sits idle for 30 minuts I want to make them
log back in order to see another page (ie turn "LoggedOn" = false).

Any ideas or suggestions?

Thanks!

 

[Hermit Dave]

Session variables reside on the server and are held in the memory for a
duration set by web.config
The default duration is 20 mins after which all the resources are released.

As you know cookie can be set to expire after certain minutes. Or you can
set sliding expiration which means that if its used then the expiration time
is reset to a certain period in future. (You manually set that).

So if you anytime you access the resources in Session always check with
something like
if(Session["objectname"] != null)
{
// read the object and process
}

equivalent vb.net is something like
if Session["objectname"] in not null then

' do whatever needs to be done
end if

--

Regards,

Hermit Dave
(http://hdave.blogspot.com)