Session Time out if browser is idle for 5 minutes

[AnuSumesh]

Hi All,

We r developing web application in asp.net using c#. we r using IIS7.0 and windows vista for development.
I m using windows authentication and "local Sytem" Identity.
I want that if user is not accessing site for 5 minutes(means browser is idle for 5 min) , after 5 min. when user clicks on any link, his session should be expired and he has to provide login credentials again.

I have tried using
<sessionState cookieless="Fal se" mode="InProc timeout="5" />

in web.config file but its not working.

Please help me in this issue.

Thanks
Anu

[Frinavale]

Thanks for reply.
1. I will try using Form Authentication if required.

2. We are preparing Web Application for System Management/Maintenance which requires to provide the facility to change date/time and ahutdown the system. I have alreday given Full(internal) trust level in IIS->webApp->.net trust Levels. But still its giving error "A required Privilege is not held by the client". What can be the problem. In any case i have to solve this issue. B'coz this is our main requirement.

Thanks 'n' Regards,
Anu

You wont be able to do system shutdowns or date/time changing with Forms Authentication alone. You'll have to use impersonation for those functions if you do switch to Forms Authentication. Basic Authentication uses Windows user accounts and will probably end up being easier to do in your case.

I'm not sure why you are getting the "required privilege is not held by the client"... are you sure that the user logging in has permissions to change the date/time or shut down?

It still feels like it's the application itself that is missing the permissions/trust.

-Frinny

[AnuSumesh]

Hi,

I am trying to implement new idea as follows(with Basic Authentication)

in master page i m coding
if (!Page.IsPostBa ck)
Response.Append Header("Refresh ", ((Session.Timeo ut)*60 + 5).ToString() + "; Url=logoff.aspx ");

the url for logoff.aspx is https://abc.com/admin/logoff.aspx.
what path i have to give in Url="" to redirect from current path where current path is as https://abc.com/admin/maintenance/sss.aspx

in logoff.aspx.cs : Session.Abondon ();
'n' providing link to goto starting url i.e. https://abc.com.

But now i have problem like: after logoff page when user click on the link then he is directly logged-in into site without authenticating.

Is there any way to clear basic auth info from browser side?

or i can close the browser after showing logoff page. for that i have tried the following javascript code:

window.open('', '_parent',''); window.close();
this code is working fro IE but not for firefox2.0 'n' above.

Can you please help me in this issue?

Thanks
Anu

You wont be able to do system shutdowns or date/time changing with Forms Authentication alone. You'll have to use impersonation for those functions if you do switch to Forms Authentication. Basic Authentication uses Windows user accounts and will probably end up being easier to do in your case.

I'm not sure why you are getting the "required privilege is not held by the client"... are you sure that the user logging in has permissions to change the date/time or shut down?

It still feels like it's the application itself that is missing the permissions/trust.

-Frinny

[Frinavale]

...
But now i have problem like: after logoff page when user click on the link then he is directly logged-in into site without authenticating.

Is there any way to clear basic auth info from browser side?

or i can close the browser after showing logoff page. for that i have tried the following javascript code:

window.open('', '_parent',''); window.close();
this code is working fro IE but not for firefox2.0 'n' above.

Can you please help me in this issue?

Thanks
Anu

That's what I was saying. There is no way to log out the user when you use Basic Authentication.

[GregoryPankov]

Hello,

I'm not sure but I think that:

1. If you are using Form Authentication then you should grant access rights to the ASP.NET request identity. ASP.NET has a base process identity typically Network Service.

2. If you are using local user identity then you should use impersonation as an authentication mode.

more about asp.net authorization you can find here:
http://www.easyalgo.co m/KnowledgeBase/... . Links to Microsoft's KB at the bottom of page.

3. If you are running you application on DEBUG mode then Session End event may not rised, becose in DEBUG mode many parameters of web configuration such as sessionTimeout, executionTimeou t are being disabled.