Question

I have read that asp.net session variable last by default 20 minutes of inactive browser.

What happens if the user logs out and immediatly logs in? Or closes the browser and restart it? The session state “dies” ?
If not- what is the alternative to make it die on evey log-out or browser closing?

Thanks

Answer 1

Session state relies completely on the presence of a cookie being provided by the browser for each request in the ‘session’. When the server takes receipt of the cookie on each request it then checks if the default 20 mins has passed since the last request.

Therefore the answers to your questions:

What happens if the user logs out and
immediatly logs in?

The cookie is marked as invalid by the server on logout and is assigned a brand new one when they log back in

Or closes the browser and restart it?

Provided the session hasn’t expired it won’t make any difference (as the browser will still send the cookie along with each request)

make it die on evey log-out or browser
closing?

You can’t make a cookie ‘die’ although you can set it’s expired date to the past. There is no way you can detect the user closing their browser.