Session Expired in Asp.Net MVC 2

Question

Some users close all the browsers and they open IE8 again and they get the message "Session Expired" in the login page, which is strange, and it only happens sometimes.

The conditions to show that message are:

var sessionTimedOut = Session.IsNewSession && Request.Headers["Cookie"] != null && Request.Headers["Cookie"].Contains(ASPNET_SESSION_COOKIE);

And normally all cookies disapear when the browser is closed, because that is the scope of these cookies.

So what could be causing this condition to be true?

Answer 1

Are you saving the value ASPNET_SESSION_COOKIE yourself into the session?...or just relying on ASP.net built in sessions handler? If you are not saving by yourself, then the following scenario might have been causing the problem.

I think your condition is not properly configured to check for expired sessions.The reasons are -

1. ASP.Net by default saves Sessions, in Cookie, Therefore whenever a new session is created so does the Cookie.

2. Lets, consider the scenario, that a session has expired, then when the request is made (that is the GET for the Login page) ASP.net is checking for a Cookie or Session and sees that it needs a new session to be created. Therefore, it creates a Session and saves the cookie.

3. Again, lets consider, this is the first time some one sees the page, again, the same thing will happen as 2. The condition is always true.

4. You need to save some custom Cookie/Session values inside the cookie/session so that you can check agains it.

I am highly suspicious that, the condition -

Session.IsNewSession && Request.Headers["Cookie"] != null && Request.Headers["Cookie"].Contains(ASPNET_SESSION_COOKIE); 

is never false, Unless you are using or checking this, before the session is handled or checked by ASP.Net.