C# .NET - Creating session timeout in web.config and global.asax

Asked By Judy Lim on 28-Oct-11 03:35 AM

In web.config, I had set <sessionState mode="InProc" cookieless="true" timeout="30" /> How do I link from here to session_end in global.asax?

dipa ahuja replied to Judy Lim on 28-Oct-11 03:44 AM

Untitled document

Web.config:

Use timeout in web.config, can also use timespan--20 minutes is default, also The timeout attribute cannot be set to a value that is greater than 525,601 minutes (1 year) for the in-process and state-server modes.

Ex:

<sessionState mode="InProc" timeout="10"/>

PAGE_LOAD

protected void Page_Load(object sender, EventArgs e)
{
  Response.AddHeader("Refresh", Convert.ToString((Session.Timeout * 60) + 5));
  if (Session["IsUserValid"].ToString() == "")
    Server.Transfer("Relogin.aspx");
}

In Global.asax:

void Session_Start(object sender, EventArgs e)
{
  Session.Timeout = 15;
  if (Session["IsUserValid"] == null)
  {
    Response.Redirect("TimeoutPage.htm");
  }
}

Judy Lim replied to dipa ahuja on 28-Oct-11 03:56 AM

Thank you for your help.
May I know if it is a must to code in page load?
And in global.asax, I need to code under Session_End and not session_start.

dipa ahuja replied to Judy Lim on 28-Oct-11 04:02 AM

Not at all, i show you three different ways. You can set session timeout in any of one.

usually we set it in the web.config. Either in web.config or Gloabal.asax both are better places to set session timeout

Judy Lim replied to dipa ahuja on 28-Oct-11 04:05 AM

Thank you
But if I want to set in web.config and link to Session_End in global.asax. Can I still follow your Session_Start code?

Jitendra Faye replied to Judy Lim on 28-Oct-11 04:08 AM

To change session timeout write this code in your web.configfile

<sessionState mode="InProc" timeout="60">

or you can also set this in global.asax file as

Session.Timeout = 60 ; // in Session.Start() event

it will increase your session expire time .

dipa ahuja replied to Judy Lim on 28-Oct-11 04:08 AM

I said you Any one from three.. If you set in web.config then no need in global.asax , if you set in global.asax no need to set in web.config

Judy Lim replied to dipa ahuja on 28-Oct-11 04:13 AM

I understand. But my teacher told me to set in web.config and link to Session_End in global.asax. So I need both.

dipa ahuja replied to Judy Lim on 28-Oct-11 04:18 AM

Ok then set in both.. but i think the global.asax value will be used for it because when we start the application the session timout value of web.config will be replaced by the value of gloabal.asax

Judy Lim replied to dipa ahuja on 28-Oct-11 04:22 AM

Thank you.
I understand that your coding is for Session_start, can I still use the same coding for Session_End and do I need coding for Session_Start?

Anoop S replied to Judy Lim on 28-Oct-11 05:13 AM

You can use global.asax's session end event to remove the unexpectedly disconnected user :

void Session_End(Object sender, EventArgs E) {
// Clean up session resources
}

but beware, session doesn't end when the user closes his browser or his connection lost. It ends when the session timeout reached.

Judy Lim replied to Anoop S on 28-Oct-11 05:20 AM

Thank you but can I have the coding to end the session?

dipa ahuja replied to Judy Lim on 28-Oct-11 07:19 AM

In session start you can start the session , set the timout for session

and in the session_end just clear all the session variables and clear session of current user for ex:

Untitled document

//Clear any particular session variable:

Session["username"] = null;

//Clear all session variables:

Session.Abandon();

Session.Clear();

Judy Lim replied to dipa ahuja on 28-Oct-11 10:20 PM

Thank you for your reply.
For the session_start, can I use this coding?

void Session_Start(object sender, EventArgs e)
{
  Session.Timeout = 15;

And for

void Session_End(object sender, EventArgs e)

{

//Clear any particular session variable:

Session["username"] = null;

//Clear all session variables:

Session.Abandon();

Session.Clear();

May I know if this is correct?

dipa ahuja replied to Judy Lim on 29-Oct-11 03:54 AM

In the session_start we are setting the timout limit of session you can even write the session variables like this:
for ex: Its like login Process

void Session_Start(object sender, EventArgs e) { Session["loginTime"] = DateTime.Now.ToString(); } And in the session_End we are clearing all the values of session variables which is some what like the logout process

Judy Lim replied to dipa ahuja on 29-Oct-11 04:46 AM

I'm a bit confused. If I want to close the session if user is inactive for 5 minutes, why do I need to put the logintime?

dipa ahuja replied to Judy Lim on 29-Oct-11 09:45 AM

we put login time for particular for ex 5 min now if user is inactive for 5 min the session is over.

But suppose user closes the browser before the session complete the session_end event will clear all the session variables.

Judy Lim replied to dipa ahuja on 29-Oct-11 11:01 AM

Thank you.
So I suppose that I still need this right?

void Session_Start(object sender, EventArgs e) { Session["loginTime"] = DateTime.Now.ToString(); }

dipa ahuja replied to Judy Lim on 29-Oct-11 11:09 AM

No no, its not must, its option, session variable you can assign any where not required in global.asax.

but if you want to get things like "site access time" then assign there in global.asax. and things like login time is starts from when the user login in the site.

Judy Lim replied to dipa ahuja on 29-Oct-11 11:18 AM

Thank you.
If I want to close the session if user is inactive for 5 minutes.
Is this coding correct -

protected void Session_Start(object sender, EventArgs e)
{

Session.Timeout = 5;
}

protected void Session_End(object sender, EventArgs e)
{
//Clear any particular session variable:
Session["memberID"] = null;
//Clear all session variables:
Session.Abandon();
Session.Clear();
}

Thank you