Session.Timeout not working correctly in ASP Classic / IIS

asp-classiciissessionsession-timeout

Recently I created a asp classic web page with which a user can insert his worked hours.

One of the requests was that the page should show a message who is logged in every 10 minutes. The user does his production on a machine and has it's computer besides him, so it is possible that a user will be inactive on the hour web page for 5 – 60 minutes (or even more), yet he will stay on the page nonetheless.

To make the pop up message every 10 minutes I used a timer created in JQuery, this all works fine. Because the total inactive time is not sure, the person wanted the session timeout to be large (24-hours) so that session state (who is logged in) remains for a long time. When a user uses the insert hour web page he is requested to select his username on a different web page and the session("user") is then set.

To accomplish the long session timeout I created a global.asa file in the root with the following code:

<script language="VBScript" runat="Server">
 <!-- METADATA 
        TYPE="typelib" 
        UUID="00000200-0000-0010-8000-00AA006D2EA4"
-->

Sub Session_OnStart

    ' Session timeout in minutes (24 hours)
    Session.Timeout = 1420

End Sub

</SCRIPT>

Though for some reason (I timed it) the timeout is still the default 20 minutes.. Then I tried to also set the Session.Timeout = 1420 in:

a. The web page of the hours inserting and

b. In the page where the user is selected and the session is being set.

This didn't had any effect though. So then I started researching it and found a similar question on stackoverflow: Session Timeout in Classic ASP website

So this made me look at my IIS settings on the server where I changed a few things.

In the application pool of the website I changed the Regular Time Interval to 0:

enter image description here

Next I also changed the Time-Out to 24 hours in the Session Properties on the Services tab of my website (under Sites):

enter image description here

However this all doesn't have any effect. It still ends the session after 20 minutes (at least it resets my session("user") state.

In the hour inserting web page the session is being checked as follows:

if session("user")="" then 
        response.redirect("ShowPage.asp?page=SelectUserTimeout")

        response.end
end if

So when the session is empty it will redirect to the select a user page where the session("user") will be set again. Though with my time-out settings, if it would actually work, this should only happen after 24 hours and not after 20 minutes.

Any ideas what's going wrong here?
I am using by the way IIS 8.0.

UPDATE

I found the problem! It seems that the Idle Time-Out (Minutes) in the Application Pool of my website was still on the default 20 minutes and for some reason my session.timeout in the asp code didn't override that.

So for anyone facing the same problem I suggest that you go to your Application Pools in IIS –> then go to the application Pool of the website –> go to advanced settings –> Process Model –> and change Idle Time-out

Best Answer

I found the problem myself! It seems that the Idle Time-Out (Minutes) in the Application Pool of my website was still on the default 20 minutes and for some reason my session.timeout in the asp code didn't override that.

So for anyone facing the same problem I suggest that you go to your Application Pools in IIS --> then go to the application Pool of the website --> go to advanced settings --> Process Model --> and change Idle Time-out

Related Topic