Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to set session timeout / expiry time in ASP.NET Core MVC?

I am using ASP.NET Zero version 7 of ASP.NET Core, MVC and jQuery project.

I am trying to set session timeout / expiry time to automatically log out from the application when the application is idle for some time. Can anybody please let me know how to do this?

In ASP.NET Zero version 8, they are providing this configuration at User Management settings.

like image 890
srinivas challa Avatar asked Dec 18 '19 09:12

srinivas challa


People also ask

How can set session timeout in ASP.NET MVC?

Open the web. config file, then increase the value in minutes by using the time out attribute of SessionState element. By default, the session timeout value is 20 minutes.

How do I set session timeout?

Click Container Settings > Session management > Set Timeout. Enter the desired timeout value in minutes.

How to set session custom timeout in ASP NET MVC?

By default, the session timeout is 20 minutes after that session will expire. So if you want to increase or extend the session custom timeout for an application. You can set it in different ways such as using Web.config, Global.asax file, or using IIS. Here are some examples to set sessions custom timeout in ASP.NET or ASP.NET MVC.

What is session state in ASP NET MVC?

ASP.NET MVC Session state is used to temporarily store and retrieve the values for a user when the user navigates to another view in an ASP.NET MVC application. Usually, the session timeout configuration setting will be stored in the web.config file in the MVC application.

How to increase the session timeout of a web application?

If you want to increase the session timeout then open your application web.config file which is placed under your application root folder. Add <sessionState timeout="300"></sessionState> code under <system.web> </system.web> the section as shown below, In this example, I have updated the timeout to 30 min

What is the timeout property in IIS?

-1 The Timeout property specifies the time-out period assigned to the Session object for the application, in minutes. If the user does not refresh or request a page within the time-out period, the session ends. IIS 6.0: The minimum allowed value is 1 minute and the maximum is 1440 minutes.


1 Answers

ASP.NET Core MVC

Session expiry for MVC is provided via cookie by ASP.NET Core, independent of ASP.NET Zero.

Call ConfigureApplicationCookie after IdentityRegistrar.Register in Startup.cs:

public IServiceProvider ConfigureServices(IServiceCollection services)
{
    // ...

    IdentityRegistrar.Register(services);                  // No change
    AuthConfigurer.Configure(services, _appConfiguration); // No change

    services.ConfigureApplicationCookie(o =>
    {
        o.ExpireTimeSpan = TimeSpan.FromHours(1);
        o.SlidingExpiration = true;
    });

    // ...
}

The defaults from ASP.NET Core v2.2.8 CookieAuthenticationOptions.cs#L30-L36:

public CookieAuthenticationOptions()
{
    ExpireTimeSpan = TimeSpan.FromDays(14);
    ReturnUrlParameter = CookieAuthenticationDefaults.ReturnUrlParameter;
    SlidingExpiration = true;
    Events = new CookieAuthenticationEvents();
}

ASP.NET Zero (for ASP.NET Core)

ASP.NET Zero v7.2.0+ provides:

  • for MVC: frontend configuration and countdown modal.
    Docs: aspnet-core-mvc/v7.2.0/Features-Mvc-Core-Tenant-Settings#user-management
  • for Angular: implementation of session timeout via token, frontend configuration and countdown modal.
    Docs: aspnet-core-angular/v7.2.0/Features-Angular-Tenant-Settings#user-management
like image 132
aaron Avatar answered Nov 01 '22 15:11

aaron