Implementing a Session Timeout Page in ASP.NET
page 1 of 5
Published: 02 Apr 2008
Abstract
In this article, Steve walks through the steps required to implement a Session Logged Out page that users are automatically sent to in their browser when their ASP.NET session expires. He examines each step with the help of detailed explanation supported by relevant source code.
by Steven Smith
Feedback
Average Rating: This article has not yet been rated.
Views (Total / Last 10 Days): 100298/ 86

Introduction

In many applications, an authenticated user's session expires after a set amount of time, after which the user must log back into the system to continue using the application. Often, the user may begin entering data into a large form, switch to some other more pressing task, then return to complete the form only to find that his session has expired and he has wasted his time. One way to alleviate this user interface annoyance is to automatically redirect the user to a "session expired" page once their session has expired. The user may still lose some work he was in the middle of on the page he was on, but that would have been lost anyway had he tried to submit it while no longer authenticated. At least with this solution, the user immediately knows his session has ended, and he can re-initiate it and continue his work without any loss of time.


View Entire Article

User Comments

Title: Mr   
Name: Lunchbox
Date: 2012-09-20 5:30:43 PM
Comment:
This approach works perfectly for me, thanks, your examples is complete and helped a lot!
Title: Mr.   
Name: chandrabhan singh
Date: 2011-02-09 6:56:32 AM
Comment:
Hi,

I have a wired scenario in one of my ASP.net application.

I am using ASP.net membership with my custom "roleManager",

and having below tag in web.config to restrict any user not having role of "Keywords"(roles) to access "Keywords"(path) folder

location path="Keywords"

system.web

authorization

allow roles="Keywords"

deny users="*"

authorization

system.web

location

If any user with some other role allow to assess this URL (Keywords in this case) will be redirected to a custom- Access denied page.

Now things working fine but when I left my application with a inactivity of 30 min I am not able to visit the "Keywords", all the time I end up with the custom- Access denied page, if I close the browser, login again it start working fine.

Please help me in this case.

Thanks in advance
Title: Css breaks with header runat server   
Name: san
Date: 2010-10-27 6:58:05 AM
Comment:
I am facing one issue using your example. when on the master page, i give runat=server attribute to head tag, other css and javascript tags added in the same section fail to load. The css of the project breaks,and when i remove this attribute, it is loaded correctly.How to solve this problem?
Title: Mr.   
Name: Raja
Date: 2010-06-09 6:10:52 AM
Comment:
I am getting the following error when run this program.
Parser Error Message: Could not load type 'SessionExpirePage.SessionExpired'.
Title: Nice code   
Name: Mike
Date: 2010-03-24 10:37:05 AM
Comment:
Thanks for putting this together. Very simple and effective.
Title: Session Timed Out.   
Name: Mohandas
Date: 2010-03-05 4:53:16 AM
Comment:
Every Time i access my web page. Session times out. I dont know what is thereason but I used the same session many times in my page.
Title: Thank you   
Name: e
Date: 2009-08-19 4:57:48 PM
Comment:
Thanks alot. Well thought out. Virtually comprehensive
Title: Very good article   
Name: Manju
Date: 2009-06-17 8:55:36 AM
Comment:
currently i am searching for this imformation, thanks for ur article
Title: Good   
Name: Amit
Date: 2009-05-31 6:53:13 AM
Comment:
it a so good article but i was a code for a refersh a page in particular slot of time
Title: Good   
Name: champ
Date: 2009-04-17 11:44:28 AM
Comment:
its a good article but i wants a code for expire a page on refresf of my page after timeout
Title: not working properly   
Name: Ramesh
Date: 2009-04-17 11:32:16 AM
Comment:
Sir ,
i m a beginner to the asp.net,i was trying to use ur code but there is a problem when session gets expired its unable to display the SessionExpired.aspx,even my address bar is showing the url of that page but its not get display.

So please tell me what i should do to resolve this problem

Ramesh
Title: Excellent   
Name: Murthy
Date: 2009-04-14 8:02:50 AM
Comment:
Very excellent, Very useful code
Title: Nice article   
Name: Sam
Date: 2009-04-13 11:46:35 AM
Comment:
It's a nice piece of code. Thanks.
Is there a way to check wether the session has expired by then? For instance, I want to save something before the session timeout.
Title: hi   
Name: Majid
Date: 2009-03-17 9:18:54 PM
Comment:
That a very nice piece of coding it really helped, thnx.
Title: hi   
Name: maha
Date: 2009-03-02 3:54:26 AM
Comment:
Nice article.
Title: Great idea   
Name: Bino
Date: 2009-02-11 7:16:21 AM
Comment:
Great work...thanks for the trick
www.codepal.co.in
Title: Nice code   
Name: Charles
Date: 2008-10-01 8:37:31 AM
Comment:
This is a nice piece of code, I will give it a try. Don't mind negative worthless persons my friend, they're like flies (very useful).
Title: Comment on Considerations   
Name: sangam
Date: 2008-09-23 6:19:16 AM
Comment:
It's a great article. Thanks for this. The only thing i want to point out is that, as explained in the Page 3 Consideration section, it is not beneficial to have this system since the page a user is currently in expires as it would expire in the first load. The trend is that with user hit to server the session time out resets and it requires complete inactivity of user for the implemented expiry time.
Thanks. http://dotnetspidor.blogspot.com
Title: Hi   
Name: Nilesh
Date: 2008-08-13 3:34:04 AM
Comment:
Hi, can u give me code for session clear after browser close asp.net
Title: sessionexpired page culture language   
Name: Mamdouh
Date: 2008-06-01 7:35:12 AM
Comment:
again may my language or question was not clear. I have used this approach of meta tag to redirect users to sessionexpired page but i wanna set this page culture language to be read directly either from resource file or from cookie but i failed to do this. any help please?
Title: Check IsAuthenticated   
Name: Steve Smith
Date: 2008-04-25 8:18:20 AM
Comment:
@sessio- just check if they are logged in and only emit the meta refresh tag if they are.
Title: sessio   
Name: liju
Date: 2008-04-25 12:34:24 AM
Comment:
hey, i have 1 prob.my site contains pages, into which i can go before login as well as after login.so how can i implement redirect to an expire page.aspx on session time out.
thanks in advance
Title: Language resource file not read correctly   
Name: Mamdouh
Date: 2008-04-23 11:32:19 AM
Comment:
I have a bi-lingual application and i have used your approach and it works but it reverses the language. Could you tell me please how to read the language to display the page with specially that you know that the session is vanished. Note that i have used the cookies to store the language into it but the SesionExpired page still display in one language.
Title: Re: Master Page Still Worthwhile   
Name: Richard
Date: 2008-04-09 10:23:37 AM
Comment:
@Steve,

If you only want a module to apply to specific folders or pages, you can configure it within a location element in the web.config file:

http://msdn2.microsoft.com/en-us/library/b6x6shw7.aspx
Title: Master Page Still Worthwhile   
Name: Steve
Date: 2008-04-04 1:04:02 PM
Comment:
@Richard,
You still want to use the master page, rather than a generic module, unless the entire site requires authentication. Usually it doesn't, and you don't want users coming to your home page and being sent to a session expired or login page.
Title: Re: Refresh Meta Tag - not required   
Name: Richard
Date: 2008-04-04 12:18:53 PM
Comment:
Using Rick's suggestion, you don't even need a master page - you can add the header from an HttpModule instead.

private void Application_PreSendRequestHeaders(object sender, EventArgs e)
{
HttpContext context = ((HttpApplication)sender).Context;
if (null != context.Session)
{
context.Response.AddHeader("Refresh",
string.Format("{0};url={1}",
60 * context.Session.Timeout,
SessionExpireDestinationUrl));
}
}
Title: Re: Refresh Meta Tag - not required   
Name: Rick Strahl
Date: 2008-04-04 4:13:38 AM
Comment:
@Steve - Nice.

One thing though: you can actually skip the meta tag and use the Refresh HTTP header that it simulates which is a bit easier:

Response.AddHeader("Refresh","6;Page.aspx");

More detail here:
http://www.west-wind.com/WebLog/posts/6841.aspx
Title: Good Point   
Name: Steve Smith
Date: 2008-04-03 9:33:40 AM
Comment:
@Herman - That's a fair point; this solution pretty much assumes that interactions that are maintaining the session are also generating new pages. If that is not a valid assumption for the application (e.g. it does a lot of AJAX or Flash/Silverlight interaction), then this approach would need to be tweaked a bit. The simplest change at that point would be to use AJAX to call back on a timer to see if the session is active, and if not, redirect. Perhaps I'll write a follow-up to demonstrate this technique, but it's not nearly as simple as this one and this one will work in a huge number of cases that don't make heavy use of AJAX.
Title: Doesn't actually have anything to do with sessions   
Name: Herman
Date: 2008-04-03 7:57:30 AM
Comment:
You only provide a way to refresh a page. Wether the session has expired by then or not is something you don't even check.

Any AJAX or other activities like opening another tab for the same website postpone the session and your refresh counter will fail completely, telling the user the session has expired even though it is not.
Title: Worthless?   
Name: Steve Smith
Date: 2008-04-02 11:48:26 AM
Comment:
Anon - Thanks for your feedback, but clearly there are others who disagree, and not all that we publish is targeted at advanced developers. Sometimes simple things have value, too. I hope, for the most part, the content you find on this site is valuable to you, and if it isn't, that it is valuable to others. Take care.
Title: Worthless   
Name: Anon
Date: 2008-04-02 5:53:07 AM
Comment:
This post is completely worthless. ASP Alliance should take care of the newly posted articles.
Title: Great & Thx   
Name: Steven Kimpe
Date: 2008-04-02 5:46:29 AM
Comment:
A realy nice short piece of code! I've implemented the code straight away into one of our websites. Thx again!
Title: another way   
Name: Vahid
Date: 2008-04-02 4:47:10 AM
Comment:
protected void Page_Load(object sender, EventArgs e)
{
if (!Page.IsPostBack)
Response.AppendHeader("Refresh", ((Session.Timeout * 60) + 5).ToString() + "; Url=login.aspx");
}
Title: Good article!   
Name: Satheesh babu
Date: 2008-04-02 4:11:04 AM
Comment:
Nice article..It is quiet neat and simple!

Regards,
Satheesh
www.codedigest.com

Product Spotlight
Product Spotlight 





Community Advice: ASP | SQL | XML | Regular Expressions | Windows


©Copyright 1998-2024 ASPAlliance.com  |  Page Processed at 2024-10-13 12:23:49 AM  AspAlliance Recent Articles RSS Feed
About ASPAlliance | Newsgroups | Advertise | Authors | Email Lists | Feedback | Link To Us | Privacy | Search