asp.net mvc session timeout

Question

How to implement a session timeout feature for an asp.net mvc application? I want user to be automatically signed out once inactivity is detected for a give time period.

I can implement an ActionFilterAttribute and apply to each method but that would not automatically sign out the user. It will sign out only when user tried to invoke the method for that action.

Thanks.

Answer 1

You ought to be able to manage this from the web.config:

<system.web>
    <sessionState timeout="x"/> 
    ...
</system.web>

I'm no MVC expert, but a change in this behaviour rolled out across ASP.NET is not something I'd expect.

This can also be configured using the IIS management application; not certain which version of IIS you're using, but this Technet article describes what should be easy to follow even in older (pre-IIS7) versions. Note that behind the scenes this method still manages the settings within the web.config file, so if this is version-controlled I wouldn't recommend changing it in this manner.