Classic ASP Session Timeout

Question

I am puzzled. Each of our employees must log in to our server, which begins its ASP session. All our studies show that we should be able to change how long this session lasts using session.timeout x , where x is the number of minutes that we want the session to continue, by default 20 minutes. I changed this timeout without any consistent results.

Finally, I installed a function that checks if I register every 10 seconds to find out if I can smooth out the agreed session length. So far, time has ranged from 7 hours to 40 hours over 8 trials. I did this in both the Chrome browser and the Firefox browser to find out about different session times, and they were always calculated at the same time. However, employees do not receive a timeout at this exact time.

I read something about global.asa. We either do not use it, or none of us understand it well enough to know where it is.

I also read and tried to change the timeout sessions for application pools in IIS. I am doing this from Windows 7, and most of the tutorials were for older versions of windows, but I think I found a suitable place, but I still could not find out that the changes I made had any meaning.

tl; dr - Is there a way to find how much time is left in a classic ASP session?

Answer 1

There are several things that can affect the length of the timeout and several places where you can set the length. IIS has its own default, and this can also be set on the site based on the site. You can also install it in your application code using session.timeout , as you suggested.

If you created a function to check for an active session, the function itself probably supports the session every time it starts. This is why you experience such long session timeouts.

A session automatically ends if the user does not request or refresh the page in the application within a certain period of time.

global.asa is a file that you can create and include in the root folder of your web application. If you need or need, then just create it.

The format should be something like this:

 <script language="vbscript" runat="server"> sub Application_OnStart 'some code end sub sub Application_OnEnd 'some code end sub sub Session_OnStart 'some code end sub sub Session_OnEnd 'some code end sub </script> 

To control the duration of a session, you can specify a value;

 Sub Application_OnStart Session.Timeout = 30 '30 mins End Sub 

One of the most accurate solutions that I have found and am using now would be to record the timestamp of the initial login and the timestamp of the last action for each specific user in the database or in the cookie. Then compare the current timestamp with the data stored to determine if the session should end. You can also use this type of method to automatically redirect the client to the login page after a set period of inactivity or displaying a message that says "your session has expired".