Session timeout is not working while using SqlServer mode

Question

I am developing ASP.Net MVC application.

We have used sessionState mode SQLServer and i have set timeout to 20 minutes.

<sessionState mode="SQLServer" 
              sqlConnectionString="data source=127.0.0.1;user id=sa;password=sa" 
              cookieless="false" 
              timeout="2" />

Code is something like this in web config.

I have also set login page.

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="2880" />
</authentication>

Now when session expires i want to navigate user to login page.

I checked many things but i was unable to understand how it exactly works? and how can i navigate user login page on session expire?

It is working in InProc mode. I used it in same way and user is redirected to login on session expire.

But i am unable to accomplish same thing in SQLServer Mode.

I am unable to understand what i am missing?

I checked Session State and also found that Session timeout handled in SQLServer Mode

Edit :- I want to redirect user to login page whenever another http request is executed for that session.

Session employs sliding timeouts. Every time you access your website again, the session timeout is reset. — Chris Pratt
@ChrisPratt Ok. how should i deal with this scenario? Is it because of SQLServer mode? — Nirav Kamani
That's what I'm saying. You can't. Session will never timeout while the user is active, whether that be 20 minutes or 2 hours. If the user is idle, and the session does timeout, the next request will simply start a new session. What you most likely want to do is simply set the authentication to expire after 20 minutes. That will necessarily force the user to re-login after 20 minutes, as that is not sliding. — Chris Pratt

John Wu John Wu · Accepted Answer · 2017-03-02T18:32:20

Ordinarily the browser has no idea what is going on on the server. Unless an HTTP round trip occurs, it will remember the state of the session from when the page was rendered.

In addition, you session cookie is probably HttpOnly, so there is no way for the page to check for the presence of a session cookie.

One way to accomplish what you want is:

Add a hidden iFrame to your page. Set the SRC of the iFrame to a handler in your web site
The handler doesn't have to do much except return a 200 OK, plus a refresh header set to a few seconds, so that the handler gets continually polled.
```
context.Response.AddHeader("REFRESH", "2");
```

Add framebreaker code to your login page

 if (top.location != location) {
    top.location.href = document.location.href ;
 }

When a request for the handler occurs with an expired session, it'll get redirected to the login page via forms authentication; when the login page is returned, it'll break your iFrame and redirect the full window to the login page.

Or, you can do what everyone else does, which is wait for the user to request another page.

Session timeout is not working while using SqlServer mode

3 Answers