IIS 6.0 and Session State Problems

Have you tried publishing a website in a development server without problems only to see them once deployed on a production server? Here's one problem you might encounter. Why does the session expire quickly when you explicitly set the timeout property in the website's web.config?

<sessionState mode="InProc" cookieless="false" timeout="30"/>

Here's a good post that explains why: WHY DO I LOSE ASP SESSION STATE ON IIS6

Now after digesting the post, I'll give a simple solution you may try to solve that problem.

Step 1:

Change the sessionState in the web.config to an out of process like StateServer.

<sessionState mode="StateServer" stateConnectionString="tcpip=localhost:42424" cookieless="false" timeout="30"/>

We'll use the StateServer mode which is ASP.NET's special session handling method. Don't change the stateConnectionString, that is simply the port that will be used by the ASP.NET State Service.

Step 2:

Now let's configure the ASP.NET State Service.

In the server hosting the website, go to Start > Run > Type services.msc

Select ASP.NET State Service and right click it and select Properties.

Make sure to select Automatic in Startup type, so the service will start automatically everytime the server reboots. Then start the service.

Step 3:


Now try running the website and see if it already follows the timeout period you set in the web.config. If it does and you haven't encountered any problems then all is good, congrats!. But if you encountered this sneaky error:

Sys.WebForms.PageRequestManagerServerErrorException: An unknown error occurred while processing the request on the server. The status code returned from the server was: 500


Then your problem might be serialization. Because sessions that will be saved in the ASP.NET State Service must be serialized. Two things to make sure is to first serialize all your local classes like this:


[Serializable]
public class SampleClass
{


}

Place a Serializable tag before the declaration of the class.

Second is to make sure you're not using classes that cannot be serialized like Web Controls (Button, Textbox, Table, etc.). Just search msdn for other non-serializable classes.

If you followed these steps your website should be running okay by now.

Here's some topics you might be interested:
Session-State Modes 
Serialization






-elyk

ASP.NET Logout on Session Expire

Here's a way to enable logout after session has expired in your ASP.NET pages.


Let us begin with the sessionState tag inside the web.config file:


<system.web>
    <sessionState mode="InProc" cookieless="false" timeout="30"/>
</system.web>


Make sure to place it inside the system.web tag. For the attributes, we use InProc mode to store the session on the local computer, cookieless is set to false which means it will store the session as cookies (if you set this to true, you will get some jumbled alphanumeric characters in your webpage's URL) and finally timeout which has a numeric value equal to how long you want your session in minutes before it expires.


For more information on sessionState attributes, check out msdn: http://msdn.microsoft.com/en-us/library/h6bb9cz9(VS.71).aspx


Now the snippet above alone will not make your page redirect automatically to your logout page after session has expired. We still need human intervention to enable that. So we add this next logic to the Master Page's page_load event (or to all pages of a website if you're not using master pages):



protected void Page_Load(object sender, EventArgs e)
{
    //1st: Every postback should pass through this code.
    //     Make a decision statement to check if user has already logged in.
    if (user has already logged in)
    {
        //2nd: Check your user session. 
               If session is null (expired) then continue.
        if (Session["user_session"] == null)
        {
            //3rd: Clear all sessions, data, connections, etc. (optional)
                   Redirect to logout page.
            .
            .
            .
            Page.Response.Redirect("logout_page", true);
        }
    }
}






Handling session expiration is required for web pages which uses sessions to store data so you won't encounter the object reference not set to an instance of an object error should your session objects expire.


-k