Question

While deveoping a site (using Forms authentication and InProc sessionstate) a frequently run into a scenario where I lose the variables stored in Session (such as Session[“myVar”]), but my auth-session remains valid.

This results in some wierd behavior on my site.

Why is this happening and what can I do to prevent diffrent lifecycles for my auth and my session variables?

Answer 1

In Asp.Net a Session and “Being logged in” are not the same thing.

Both are (usually) controlled by cookies, but the cookies are separate.

To control how long a Session is kept alive, please see answer by Jonas T.

To control how long a user remains logged in, you can use the timeOut on the <forms ... /> element:

<system.web>
    <authentication mode="Forms">
        <forms loginUrl="~/Account/Login.aspx" timeout="120" slidingExpiration="true"/>
    </authentication>
    ...
</system.web>

To get rid of your problem you should make sure that the session timeout is at least as long as the forms authentication timeout.

If you are allowing persisted cookies in forms authentication (“Remember me”), then there are no gurantees. In that case you just have to set the session timeout to “long enough” according to some criteria/specification.

Edit: Also check the settings on your application pool (under IIS) where the site is deployed. And specifically check what the “Idle Time-out” is. If this is set low (default value is 20 minutes I think), then IIS will shut down the application pool if no request have come in during that time. That (of course) terminates whatever in-proc sessions existed.