ASP.NET MVC 4 Session Timeout

Question

I am developing an Internet application with ASP.NET MVC4 using VS 2012, IIS 7.5. I use Autodesk Forms for the same. The settings in my web configuration are as follows.

<authentication mode="Forms">
    <forms loginUrl="~/Account/Login" timeout="30" name="userInfo" slidingExpiration="true" enableCrossAppRedirects="false" protection="All" >
    <credentials passwordFormat="Clear"/>
  </forms>
</authentication>

But the Idle Timeout (minutes) parameter in IIS is 20. When I update my application after 20 + minutes, I get an error when one of my session objects is null. But if I update my application after 30 minutes, it works fine, which redirects me to the login page. After entering the credentials, I correctly moved to the corresponding page.

I don’t understand why I get an error message after 20 minutes! as far as I know). Please, help.

thank

Answer 1

Form authentication does not handle the session timeout. Instead, you want to configure a session state timeout. MSDN contains additional information about the sessionState element for web.config.

If you are going to use session state, I will read different providers. If you ever want to scale your application outside of one web server, you will want to use a different session provider than InProc. Using a session provider outside the process requires the objects to be serialized, which is likely to cause the change to break later. Make changes now to save your headaches later.