We have an ASP.Net 3.5 website running on Windows Server 2008 with IIS7. The session timeout period for this site is configured to be 20 minutes - however, it is currently lasting for between 40 and 50 seconds. After researching the problem we investigated several configuration values which could be involved in the timeout period but none of them are set to less than 20 minutes. The areas we look are as follows:

  • web.config system.web/sessionState element (20 minutes).
  • web.config system.web/authentication/forms element (not present, defaults to 30 minutes).
  • Sites/{website}/ASP/Session Properties/Time-out (20 minutes).
  • Application Pools/{appPool}/Advanced Settings/Process Model/Idle Time-out (20 minutes).

We've also noted that the CPU is staying around 0% and that RAM usage is flat-lining around 1.07 GB (of 8 GB available) - so there is no performance-based reason for IIS to be recycling the Application Pool as far as we can tell.

Are there any settings we've overlooked which could cause the session timeouts to be expiring so quickly?


A couple of additional points:

  • This is not occurring in development, only on the server.
  • The session is not sliding (i.e. if we refresh the page a few times it still times out approximately 40 - 50 seconds after the session was created.

When the worker process crashes and is recycled all sessions get lost too. Did you check your eventlog for anything strange?

  • Well, I'm not sure why I didn't try this in the first place but it lead me to find the cause of the problem. The issue was actually related to excessive virtual memory consumption (someone had configured it wrong in IIS for the App Pool in question). Thanks for the tip. – Zac Mar 22 '12 at 12:48

It can be overridden in code. Session.Timeout = nn minutes.

The ASP.NET application may also have some code for security purposes to expire and abandon sessions. This is done with Session.Abandon(). You may want to validate that the session is not being removed in the application. Hopefully the application has some type of logging in the authentication code that would help reveal the session activity.

Session expiration is also sliding. So if you frequently connect to the web site every few seconds, it really should not expire. If so, something is definitely jacked.

  • Yeah, well I'll give the code timeout a go - though we were hoping this was just some strange config problem. We're not doing anything to abandon the session though. This problem was made apparent due to a recurring AJAX call to an ASHX with IRequiresSessionState (which should cause the session to slide) - but we also tested by just refreshing a page rapidly and the same result occurs. So yeah, the session sliding doesn't appear to be working... – Zac Mar 21 '12 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.