Session never expires

[Daniel Geisenhoff]

Hi,

we have set our session timeout in web.config and in IIS to 1 minute,
but the session never expires. We check a variable Session("UserId ")
in global.asax, which is still valid after 10 minutes.

here is our code in global.asax:

Private Sub Global_AcquireR equestState(ByV al sender As Object, ByVal e
As System.EventArg s) Handles MyBase.AcquireR equestState
If Not LCase(Request.P ath).EndsWith(" default.aspx") And _
Not LCase(Request.P ath).EndsWith(" frontdoor.aspx" ) Then
If Session("UserId ") Is Nothing Then
Response.Redire ct("frontdoor.a spx", True)
End If
End If
End Sub

and this is our session state part in web.config:

<sessionState
mode="SQLServer "
stateConnection String="tcpip=1 27.0.0.1:42424"
sqlConnectionSt ring="data
source=PIII550; Trusted_Connect ion=no;uid=sa;p wd=xxxxx"
cookieless="tru e"
timeout="1"
/>

We know that form authentication would be a better approach for this
purpose, but forms authentication does not work if a browser blocks
cookies.

Does anyone have an idea?

Many thanks in advance.
Daniel Geisenhoff

[Eliyahu Goldin]

Can you check the value of Session.IsNewSe ssion?

Eliyahu

"Daniel Geisenhoff" <dg*********@mi croteq.ch> wrote in message
news:27******** *************** ***@posting.goo gle.com...

Hi,

we have set our session timeout in web.config and in IIS to 1 minute,
but the session never expires. We check a variable Session("UserId ")
in global.asax, which is still valid after 10 minutes.

here is our code in global.asax:

Private Sub Global_AcquireR equestState(ByV al sender As Object, ByVal e
As System.EventArg s) Handles MyBase.AcquireR equestState
If Not LCase(Request.P ath).EndsWith(" default.aspx") And _
Not LCase(Request.P ath).EndsWith(" frontdoor.aspx" ) Then
If Session("UserId ") Is Nothing Then
Response.Redire ct("frontdoor.a spx", True)
End If
End If
End Sub

and this is our session state part in web.config:

<sessionState
mode="SQLServer "
stateConnection String="tcpip=1 27.0.0.1:42424"
sqlConnectionSt ring="data
source=PIII550; Trusted_Connect ion=no;uid=sa;p wd=xxxxx"
cookieless="tru e"
timeout="1"
/>

We know that form authentication would be a better approach for this
purpose, but forms authentication does not work if a browser blocks
cookies.

Does anyone have an idea?

Many thanks in advance.
Daniel Geisenhoff

[microteq]

After 5 minutes, the session.isnewse ssion is still false.

Thanks.
Daniel

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

[Eliyahu Goldin]

Daniel,

Note that the session timeout refers to the inactivity time. If you are
serving requests all the time, the session will never expire. Are you sure
no requests arrive within your timeout period?

Eliyahu

"microteq" <mi******@devde x.com> wrote in message
news:%2******** ********@TK2MSF TNGP14.phx.gbl. ..

After 5 minutes, the session.isnewse ssion is still false.

Thanks.
Daniel

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

[microteq]

As I am the only user, I am quite sure of that.

Or can I serve requests without explicitely posting my page?

Thanks.
Daniel.

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!