Web Service Session Timeout and Session ID reuse

[Carson Saunders]

I have a C# client application that calls a web service. I implement the
CookieContainer class on the client to ensure the session is kept.
However, I'm having trouble with the session timeout. I have set the
timeout to be one minute and have done this in IIS, in web.config, and in
global.asax. My problem/question relates to the re-use of the session ID.
When I start my client app, I retrieve the session ID from the web service
by calling a web method that returns it. Next, I let my app sit for about
5 minutes (5 times longer than the time out value). Now, when I retrieve
the session ID from the web service (using the same web method as before),
it returns the same ID, even though the IsNewSession property of the
Session is true (so I know that it really did timeout). Can someone point
me to some documentation about this? It appears as though the session ID
is being passed from the client to the web service through some sort of
header. The web service must start a new session (because the old one did
timeout) but uses the SessionID passed to it from the client. Does this
seem right? Any thoughts? Feel free to ask for more information.

Thanks

--
Carson Saunders

reply to carson_saunders at yahoo dot com