Question

By default the session expiry seems to be 20 minutes.

Update: I do not want the session to expire until the browser is closed.

Update2: This is my scenario. User logs into site. Plays around the site. Leaves computer to go for a shower (>20 mins ;)). Comes back to computer and should be able to play around. He closes browser, which deletes session cookie. The next time he comes to the site from a new browser instance, he would need to login again.

In PHP I can set session.cookie_lifetime in php.ini to zero to achieve this.

Answer 1

If you want to extend the session beyond 20 minutes, you change the default using the IIS admin or you can set it in the web.config file. For example, to set the timeout to 60 minutes in web.config:

<configuration>   <system.web>     <sessionState timeout='60' />     ... other elements omitted ...   </system.web>   ... other elements omitted .... </configuration> 

You can do the same for a particular user in code with:

Session.Timeout = 60 

Whichever method you choose, you can change the timeout to whatever value you think is reasonable to allow your users to do other things and still maintain their session.

There are downsides of course: for the user, there is the possible security issue of leaving their browser unattended and having it still logged in when someone else starts to use it. For you there is the issue of memory usage on the server – the longer sessions last, the more memory you’ll be using at any one time. Whether or not that matters depends on the load on your server.

If you don’t want to guesstimate a reasonable extended timeout, you’ll need to use one of the other techniques already suggested, requiring some JavaScript running in the browser to ping the server periodically and/or abandon the session when a page is unloaded (provided the user isn’t going to another page on your site, of course).