Prevent IIS Session Timeout in ASP.NET

There are scenarios that a user may want to keep a long session alive. For example, a help desk operator logs into a web application and takes phone calls and in between submits changes to the backend systems. The phone call may last over an hour and the operator may stay in one web page and need that session to be valid when she submits the changes.

In ASP.NET, there are several common simple solutions for that. One of them is to set the session timeout attribute (minutes) in web.config.

1
<sessionState mode ="InProc" timeout="xxx"/>




Some people are confused at the timeout setting in web.config and another in IIS and ask which overwrites which.
However, this is not complete for ASP .NET 2.0+. Open IIS->Application Pools->Select the Application pool for your application->Advanced Settings, set the idle timeout for xxx minutes".

Otherwise, the worker process is still stopped after 20 minutes(default) and your session state will be lost.



Another way, if we do not want to rely on the settings in IIS, is to keep the session alive by ourselves in the application. Some people use an invisible frame and set auto refresh in http header, but if you are using a master page, that behavior will be propagated to all ASP pages. With .NET 2.0+ and a little bit Ajax, we have a simpler solution - add a timer in UpdatePanel. The timer will trigger a partial postback periodically, thus prods the session to be aliverwrites the setting in IIS.

<asp:Content ID="ct" ContentPlaceHolderID="cphMain" runat="Server">

  <asp:ScriptManager ID="scriptMgr" runat="server" />

  <%-- Your content here --%>

  <%-- Heartbeat every 15min to keep session alive --%>

  <asp:UpdatePanel ID="updatePanel" runat="server">

    <ContentTemplate>

      <asp:Timer ID="timerPing" runat="server" Interval="900000">

      </asp:Timer>

    </ContentTemplate>

  </asp:UpdatePanel>

</asp:Content>