Session never expires

[Daniel Geisenhoff]

Hi,

we have set our session timeout in web.config and in IIS to 1 minute,
but the session never expires. We check a variable Session("UserId")
in global.asax, which is still valid after 10 minutes.

here is our code in global.asax:

Private Sub Global_AcquireRequestState(ByVal sender As Object, ByVal e
As System.EventArgs) Handles MyBase.AcquireRequestState
If Not LCase(Request.Path).EndsWith("default.aspx") And _
Not LCase(Request.Path).EndsWith("frontdoor.aspx") Then
If Session("UserId") Is Nothing Then
Response.Redirect("frontdoor.aspx", True)
End If
End If
End Sub

and this is our session state part in web.config:

<sessionState
mode="SQLServer"
stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data
source=PIII550;Trusted_Connection=no;uid=sa;pwd=xx xxx"
cookieless="true"
timeout="1"
/>

We know that form authentication would be a better approach for this
purpose, but forms authentication does not work if a browser blocks
cookies.

Does anyone have an idea?

Many thanks in advance.
Daniel Geisenhoff

[Eliyahu Goldin]

Can you check the value of Session.IsNewSession?

Eliyahu

"Daniel Geisenhoff" <dg*********@microteq.ch> wrote in message
news:27**************************@posting.google.c om...

Hi,

we have set our session timeout in web.config and in IIS to 1 minute,
but the session never expires. We check a variable Session("UserId")
in global.asax, which is still valid after 10 minutes.

here is our code in global.asax:

Private Sub Global_AcquireRequestState(ByVal sender As Object, ByVal e
As System.EventArgs) Handles MyBase.AcquireRequestState
If Not LCase(Request.Path).EndsWith("default.aspx") And _
Not LCase(Request.Path).EndsWith("frontdoor.aspx") Then
If Session("UserId") Is Nothing Then
Response.Redirect("frontdoor.aspx", True)
End If
End If
End Sub

and this is our session state part in web.config:

<sessionState
mode="SQLServer"
stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data
source=PIII550;Trusted_Connection=no;uid=sa;pwd=xx xxx"
cookieless="true"
timeout="1"
/>

We know that form authentication would be a better approach for this
purpose, but forms authentication does not work if a browser blocks
cookies.

Does anyone have an idea?

Many thanks in advance.
Daniel Geisenhoff

[microteq]

After 5 minutes, the session.isnewsession is still false.

Thanks.
Daniel

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

[Eliyahu Goldin]

Daniel,

Note that the session timeout refers to the inactivity time. If you are
serving requests all the time, the session will never expire. Are you sure
no requests arrive within your timeout period?

Eliyahu

"microteq" <mi******@devdex.com> wrote in message
news:%2****************@TK2MSFTNGP14.phx.gbl...

After 5 minutes, the session.isnewsession is still false.

Thanks.
Daniel

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

[microteq]

As I am the only user, I am quite sure of that.

Or can I serve requests without explicitely posting my page?

Thanks.
Daniel.

*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!