Session Timeout not working!

@nbcrockettJun 25.2007

Can anyone tell me why my sessions don’t last for 60 minutes. I’ve set the session timeout for 60 minutes in my global.asa file, in the application configuration for the site, in the ASP.NET configuration for the site, and for the ASP.NET global configuration. My sessions timeout at 20 minutes mostly but they also timeout at 30, 40, and 60 minutes. I have multiple sites on this server, but only this one site needs to be set at 60 minutes. Also, can anyone tell me the heirarchy for the session timeout feature. Thanks!

to post a comment

13 Comments(s) _↴

@buntineJun 25.2007 — #I generally set the value from IIS itself (I believe this is what you mean when you say "Application Configuration", but just in case).

Here is how its done in IIS5.1 (and probably 6.0):

1) Right-click your Virtual Directory. Go to Properties

2) From the "Vitural Directory" tab, click the "Configuration" button

3) Open the "Options" tab

4) Set the "Session Timeout" value to 60.

Also, make sure you restart IIS by running "iisreset" from the Run dialog. Also write "Session.Timeout" to a page to see what IIS thinks the timeout value is.

Cheers,

Andrew

@nbcrockettauthorJun 26.2007 — #That is what I meant by Application Configuration. I used the iisreset command and I added the Session.Timeout code to a page. Unfortunately I still have the problem, but the server is saying that the session timeout is 60 minutes. I've kept an eye out for anything else and noticed that when a users session ends it seems to end other users sessions as well, but not everytime. Nothing it's doing is very consistant. :mad: You should also know that the way I'm tracking that a session has ended is by using the Session_OnEnd event in the global.asa file to write to a database that a person has logged off. This coud be part of the problem, but I have this code running on my laptop and it works fine. Of course my laptop is running Win XP IIS 5.1 with only 1 website and only me logging in, while the live site is on a Win 2003 server with IIS 6 running a dozen websites and has several people logging into this particular interface. Here's the code for the global.asa file just in case you think that it might be the problem.

[CODE]
 <script Language="VBScript" RUNAT=Server>
 Sub Session_OnStart()
 Session.Timeout = 60
 End Sub
 
 Sub Session_OnEnd()
 If Session("strSessionID") <> "" then
 Dim connKeiger
 
   Set connKeiger = Server.CreateObject("ADODB.Connection")
   connKeiger.ConnectionString = "DSN=Keiger.dsn"
   connKeiger.Open
 
   Dim rsInterfaceLogins
   Dim rsInterfacePages
   Dim strSelect
 
   Set rsInterfaceLogins = Server.CreateObject("ADODB.Recordset")
   strSelect = "SELECT LoginID, SessionID, User, LoginDate, LoginTime, LogoutDate, LogoutTime, AutoLogout FROM tblInterfaceLogins WHERE SessionID = '" & Session("strSessionID") & "'"
   rsInterfaceLogins.Open strSelect, connKeiger, , adLockPessimistic
 
   rsInterfaceLogins("LogoutDate") = Date
   rsInterfaceLogins("LogoutTime") = Time
   If Session("strAutoLogout") = "Yes" or Session("strAutoLogout") = "" then
   rsInterfaceLogins("AutoLogout") = "True"
   End If
   rsInterfaceLogins.Update
 
   rsInterfaceLogins.Close
   Set rsInterfaceLogins = Nothing
 
   Set rsInterfacePages = Server.CreateObject("ADODB.Recordset")
   strSelect = "SELECT * FROM tblInterfacePages WHERE SessionID = '" & Session("strSessionID") & "' ORDER BY PageDate DESC"
   rsInterfacePages.Open strSelect, connKeiger, , adLockPessimistic
 
   If IsNull(rsInterfacePages("PageOutDate")) and IsNull(rsInterfacePages("PageOutTime")) then
   rsInterfacePages("PageOutDate") = Date
   rsInterfacePages("PageOutTime") = Time
   rsInterfacePages.Update
   End If
 
   rsInterfacePages.Close
   Set rsInterfacePages = Nothing
 
   connKeiger.Close
   Set connKeiger = Nothing
  End If
 End Sub
 </script>
 [/CODE]

Thanks!

@ChikaraJun 29.2007 — #If the server is writing that your timeout is at 60 minutes, most likely it's not your global.asa that is the problem. Also, the fact that it is inconsistant leads me to believe that 2 things could be happening.

1.) The session.timeout value is getting overwrote somewhere on your site.

2.) Something is ending your session when it shouldn't.

Is this something that started recently? If that is true, look at files that you have changed recently to make sure that they aren't ending the session or playing with the timeout value.

You say you are running many sites. Are they all sharing the same domain?

www.website.com/webby1

www.website.com/webby2

I believe that these all share one common global.asa. One problem that you might run into is let's say you have some constants for each site. Those constants will overwrite your timeout in your global.asa file. I hope this helps.

@nbcrockettauthorJul 02.2007 — #1.) The session.timeout value is getting overwrote somewhere on your site.[/QUOTE]
I've checked every page on my site to make sure that I'm not using the Session.Timeout function anywhere except the global.asa for that site. Is there any other code that could cause this? I only know of Session.Timeout.
2.) Something is ending your session when it shouldn't.[/QUOTE]
I have no idea what could be causing it to end prematurely. Any ideas?
Is this something that started recently? If that is true, look at files that you have changed recently to make sure that they aren't ending the session or playing with the timeout value.[/QUOTE]
I have no idea. I've only recently written the code in my global.asa file that writes to the database to track it, but it could have been happening long before that.
You say you are running many sites. Are they all sharing the same domain?

www.website.com/webby1

www.website.com/webby2[/QUOTE]
I'm not running multiple sites under one domain. I do have sub domains running, but in IIS they are created as seperate sites.

sub1.domain1.com

sub2.domain1.com

sub1.domain2.net

sub2.domain2.net

sub1.domain3.org

sub2.domain3.org
I believe that these all share one common global.asa.[/QUOTE]
From my understanding your right, they do share one common global.asa file per site. Since these are setup as seperate sites I thought each had it's own global.asa file. I could be wrong, so please correct me if so.
One problem that you might run into is let's say you have some constants for each site. Those constants will overwrite your timeout in your global.asa file. I hope this helps.[/QUOTE]
What do you mean by constants? Examples if possible.

@ChikaraJul 02.2007 — #I believe sub domains each have their own global.asa file.

What do you mean by constants? Examples if possible.

What I mean is this. Let's say for each of your sub domains you have an ASP file that has some constants. By constants, I mean things by admin e-mail address, some cookies and other things. These things would normally be included in a global.asa file, but sometimes are wrote into a constants.asp file or something simliar.

example

constants.asp

[CODE]
 <%
 strAdminEmail = "[email protected]"
 strSQLConnction = "Long ass sql connection string here"
 session.timeout = 20
 %>[/CODE]

I think what might be happening is that when you are navigating around your site, your session.timeout is getting over written by some file that includes constants.

What are the expected session.timeout values for each of your subdomains?

Perhaps this would explain it better.

Let's say

sub1.domain.net has a timeout of 60

sub2.domain.net has a timeout of 20

Now let's say that you 1st visit sub1.domain.net and your session.time gets set to 60. Now let's say that you visit sub2.domain.net and your timeout gets over wrote to 20. Now let's say you go back to sub1.domain.net and for some reason your timeout doesn't get reset back to 60. See what I mean?

I had this happen on one of my sites because global.asa was setting it when the session began, but in some areas of the site I was including a constants file that over wrote the session.timeout value. The easiest way to look into this is just search every time on your webserver for the text session.timeout.

@nbcrockettauthorJul 02.2007 — #I've checked every page on my site including files like include files and files that are only executed by other pages. No file on my site except global.asa has the Session.Timeout function in it. And this subdomain is the only one that has it set in the global.asa file. All the others are set in the properties of the website in IIS. This site is also the only one that executes code within the global.asa file. Some of my other sites are set to other timeout values, but I'm not going to them while logged into this site. Should I add the Session.Timeout function to every page on my site? Thanks for your help!

@ChikaraJul 02.2007 — #Very strange indeed. I can't think of anything else off the top of my head. Is this problem happening only in the office, or does it also happen when you are accessing your site remotely?

@nbcrockettauthorJul 02.2007 — #Truthfully I haven't tried, but for the most part this site will be accessed internally. I'll try tonight and see what happens. Thanks again!

@ChikaraJul 02.2007 — #One thing to consider is that some other hardware is messing with this. Namely, a firewall. Slim chance that this is the case, but could be the problem. I'm sorry I can't give you an clear cut solution for this one.

@nbcrockettauthorJul 02.2007 — #In this case it couldn't be the firewall. I'm not even going through the firewall to get to the site since it's internal. Any other hardware that could cause such a problem?

@ChikaraJul 02.2007 — #Not that I can think of. I'll try to think of something else. :/

@nbcrockettauthorJul 03.2007 — #I tested how it acted externally and I get the same screwed up results. Thanks!

@ChikaraJul 03.2007 — #Hmm. Well I mean one thing you can try to do to narrow down the problem is create a page that you can run in parallel to your webpage. Just make this page refresh every few seconds. On this page display session.timeout(). At least this way you can watch the session.timeout variable and see if it changes.

My money is still on that somehow this variable is being changed somewhere. If nothing else this will rule that possibility out.

Success!

Help @nbcrockett spread the word by sharing this article on Twitter...

Tweet This

Session Timeout not working!

13 Comments(s) _↴

Success!

Social

Version

Session Timeout not working!

13 Comments(s) ↴

Success!

The web is an endless sea of information. Don't miss the boat... Subscribe!

Social

Version

13 Comments(s) _↴