Cannot set timeout with asp.net 1.1 over than 20 minutes

[Masso]

Hallo to the group,

my question is this: where i have to set timeout in a web application?
If i set into sessionState with property Timeout="60", after 20
minutes the session is over. Always after 20 minutes, i cannot set a
timeout greater than 20 minutes.

Our configuration is the following:
- Server with Win2003, i.e. IIS 6.0
- Web application developed with vb.net simply composed by:
- login.aspx (only one button that make setAuthCookie)
- home.aspx: label showing the time of the last postback and a
button to make a postback.
- session_timeout.aspx: just to show that the session is over
- a class from which our pages are inherited; that class permit to
check when a new session is started and redirect to
session_timeout.aspx. The only method in our class is:
Protected Overrides Sub OnInit(ByVal e As EventArgs)
MyBase.OnInit(e)
If Session.IsNewSession Then
Dim cookie_header As String = Request.Headers("Cookie")
If Not cookie_header Is Nothing AndAlso
cookie_header.IndexOf("ASP.NET_SessionId") >= 0 Then
Response.Redirect("session_timeout.aspx")
End If
End If
end sub
- web.config with:
<authentication mode="Forms">
<forms loginUrl="login.aspx" name=".TESTCOOKIE" timeout="480"/>
</authentication>
.....
<authorization>
<deny users="?" />
</authorization>
.....
<sessionState mode="InProc" cookieless="false" timeout="60" />

Setting home.aspx to be the start page, i get first the login.aspx
and, after a click on the "stupid login button", i get the home.aspx.
I try to click to the "postback" button after 20 minutes, and the
application show me the session_timeout.aspx

Please help me...
Thanks in advance

 

[bruce barker]

check the idleTimeout setting. inproc sessions are lost when asp.net
recycles.

-- bruce (sqlwork.com)

 

[seguso]

check the idleTimeout setting. inproc sessions are lost when asp.net
recycles.

Thank you. Unfortunately idleTimeout is already set to infinite, which
is the default. Next guess?



Maurizio

 

[Juan T. Llibre]

re:
!> I cannot set a timeout greater than 20 minutes.

Session timeout and forms authentication timeout are two different things.

A session will last for as long a period as you set in <sessionstate...>

A period of time for your app to remember your login parameters is different.
That's set in the forms timeout property.

ASP.NET membership doesn't need for a session to be active
in order to remember whether your membership parameters are active.

One of those parameters is the time for the app
to remember whether you're logged in or not.

You can choose to base your app on the length of the session,
or on the time needed for your login to expire.

If you're using forms authentication, modify the forms authentication timeout :

<forms name=".ASPXAUTH" loginUrl="login.aspx" protection="All" timeout="30" path="/"
requireSSL="false" slidingExpiration="true">

 

[Juan T. Llibre]

Adding to this reply:

You're using :
<forms loginUrl="login.aspx" name=".TESTCOOKIE" timeout="480"/>
</authentication>

You should add slidingExpiration="true" :

<forms loginUrl="login.aspx" name=".TESTCOOKIE" timeout="30" slidingExpiration="true"/>
</authentication>

btw, are you sure you want to set the expiration to 8 *hours* ?

There's lots of background info on forms authentication parameters at :

http://support.microsoft.com/kb/910443

....and here's a link which shows you how to troubleshoot forms authentication:

http://support.microsoft.com/kb/910439/

 

[Masso]

We discovered that using situation: by using

System.Web.Security.FormsAuthentication.SetAuthCookie("testuser",
False)
the system create an AuthCookie with 20 minutes for timeout.

Using the following:
Dim userData As String = "ApplicationSpecific data for this
user."
Dim ticket As New FormsAuthenticationTicket(email,
isPersistent, 70)
' Encrypt the ticket.
Dim encTicket As String =
FormsAuthentication.Encrypt(ticket)
' Create the cookie.
Response.Cookies.Add(New
HttpCookie(FormsAuthentication.FormsCookieName, encTicket))
we are able to set the timeout. It works great!!!
Deploying the application on another server and testing with http://localhost/...
we have timeout again when postback after 20 minutes.
The difference between the develop and the test environement are the
following:
- Develop: WinXp pro SP2 Test: Win2003 Server
- Develop: IIS 5.1 Test: IIS 6.0
- Both framework: 1.1.4322

Any other ideas?