ASP session expiration before timeout setting

3
votes

Some of my legacy program is using ASP (not ASP.Net), and even if I set long session expire time, for example to 20 minutes, sometimes in short time (e.g. in several minutes) I will still notice session expire error box –

"too much idle time, please login again."

Any ideas to analyze further? Not sure whether it is my code bug or server (browser) configuration issue, since not all client/server combinations are met with this strange issue.

The session expire box is triggered by my code:

<%
    if session("timeToken") = "" then
%>

<script language = "JavaScript">
<!--
window.alert ("too much idle time, please login again");
//-->
</script>
<%
response.End()
end if
%>
4
sessionasp-classic
Where is the code you've provided? If it's javascript/vbscript on the client side, you shouldn't be able to get session variables, and if it's server side, you shouldn't be able to do an alert... - Damovisa
@Damovisa, I have posted my code. Any ideas what is wrong? - George2
Gotcha - I refreshed and you'd updated the code :) - Damovisa

4 Answers

1
votes

Make sure you site stays in the same case sensitive folders

e.g.

http://myserver.com/MyWebSite/

does not have the same session cookie as

http://myserver.com/mywebsite/

So it would log you out.

1
votes

It could be the IIS limitation on your application seesion timeout.

Try this:

  1. Right click on you app folder in IIS
  2. Then go Properties -> Virtual Directory Tab -> Then the Configuration Button on the right bottom
  3. If it's disabled, then create the application first clicking the button Create
  4. Under the configuration window click on the Options tab and you will find SESSION TIMEOUT set by default to 20(mins)

hope this is the aswer to your prayers :)

1
votes

Check that the application pool your app runs in is not recycling for some reason. For example does it have a more aggressive idle timeout (in a test scenario you may be the only on using the app and hence your not using it constitutes not just an idle session but an idle application).

The all sorts of different reasons that tha app pool can be configured for that will trigger a recycle.

Check the event logs when you have an unexcepted timeout, does anything look unusual there?

1
votes

A couple of ideas based on your update:

  1. Is there another reason your session("timeToken") could be empty? Another piece of code somewhere or perhaps the variable was misspelled somewhere?

  2. How does the actual value of session("timeToken") change in your code? Is it set when the session starts? Is it updated periodically? What value does it store?

The code you've written seems to be fine, so if it's not a code issue it will likely be a genuine session problem... just some things to check first.

Updates:

  • ASP session state is generally maintained using cookies - could you check that the client has cookies enabled?
  • Is the ASP application served by more than one server? If it's being served from a web farm or cluster, you'll need to make sure that session state can persist across the machines or that a user's session is "sticky" - that is, it's always served by the same server.

More information and help can be found here: http://msdn.microsoft.com/en-us/library/ms972338.aspx