Develop Reference

When do session variables go away?

I have a single-page, .NET 4.7.1 MVC application. My Page_Load() for Default.aspx.cs sets session variables and, when my breakpoint at the last line of Page_Load() is hit, the session object is stored correctly. However, when I click a link and hit my breakpoint on the first line of Page_Load() for the second call, HttpContext.Current.Session has no session variables set. Also, HttpContext.Current.Session.SessionID changes after the first call and then remains the same. Subsequent calls work correctly but the first one after an app pool recycle is always empty.
I have no httpCookies entry in the web.config and I'm always accessing via HTTPS. The app is running in an azure app service and I'm using OpenID Connect for authentication. Under what circumstances are variables removed from HttpContext.Current.Session before timing out?
UPDATE: I've added some diagnostic logging and sometimes SessionID changes without dropping the actual session data. I don't know how this can be but thought I'd record it. Also, it appears that my logging of the session ID has fixed the problem. I've seen others mention that the session is not preserved until it's been accessed (which is happening) but (without having searched exhaustively) I suspect all the session reading and writing in the first call is taking place in other assemblies and therefore perhaps not being 'counted' as reason to preserve the session? This seems very hokey but is my only guess for now. I'm still confused why it would have started breaking now.

Session expired before timeout

I set sessiontimeout in web.config file like following.
<sessionState timeout="120"
cookieless="false"
mode="InProc"
/>
Some times above code working fine.But many times session expired after 10 to 15 minutes automatically.
and this errors exists in every browser.
when i run same application using .net on my local computer it working fine.
Please note that, i haven't create global.ascx file yet.

Sessions will also be reset when the application recycles. This will happen when you change some things in the site, like change anything in the "bin" folder or modify the "web.config" file.
Also IIS may stop or recycle applications that it thinks are not used at the moment.
Are you sure you want to keep everything in memory for two hours, even after the user left? Better ways to keep the session alive would be to use some regular (every few minutes) AJAX callback. Search for "session keep alive asp.net ajax".

Have you verified the session timeout the app is ending up with? Do a response.write of Session.Timeout. This value can be set in several places.
How do you know the user is being active? The session will time out if he's only typing text, scrolling, and/or reading for lengths of time greater than the timeout value. The browser must invoke a HTTP request to the server to reset the timer.
As Hans mentioned, a background script-based "pinger" set to run at interval to access minimal web content will help.
Considering I'm about to start yet another web application, and I seem to need to add this functionality to most web apps, I was inspired to create a little package called Keep Me Alive to speed this process up in the future. You can find it here:
http://kma.codeplex.com/
Hope it helps!

force Session_Start

How can I force the Session_Start method on my global.asax to be called every time my application runs in development mode?
I have some code that I need to debug but sometimes it is called, sometimes it isn't.
I already tried closing the "ASP.NET Development Server" but no luck.

Check out this article http://sandblogaspnet.blogspot.com/2008/03/methods-in-globalasax.html
Session start event is fired only when a new session for a user starts. Once “Session_Start” for a user is fired then if the user makes subsequent request to any resource within the application this event is not at all triggered. The event is triggered only when the user’s session expires and then the user tries to access any resource in the application again.
Are you sure you aren't looking for Application_Start? If not then as long as you reset the session that event should be called.
EDIT: Also check out this article on someone who was trying to do the same thing as you http://forums.asp.net/t/1608241.aspx/1
From that page:
You are right I just tested it by putting <sessionState timeout="1"/> in my Web.config file.
Then I waited 1 minute and clicked on a link on the page. It
immediately went back into Session_Start and re-authenticated the
user.
EDIT 2: Try calling Session.Abandon() from your start page. It should remove the session and require the user to start a new one.

I manage to do it by restarting the "ASP.NET State Service" which is the service used to manage session state on a computer.
Not the ideal solution but solves my problem.

It can be a pain in the butt, but a combination of restarting the ASP.net Development Server and closing and reopening your browser should reset Session.

ASP.Net - How can we update row in database table if browser is closed

I have an asp.net web-forms application which is using entity model. When a users logs in, we create a row in user_session table with timein. and when user logs out we update that row and put timeout.
Now problem is, when user closes the browser without logging out, how can we update the row in user_session table?

You can't. There is no way of the server being notified that a browser has been closed by the client. The best you could do is to schedule some job on your SQL Server which runs and updates rows. You may try also subscribing for the Session_End event in Global.asax but be careful because this event might never be triggered if you are using an out-of-process session.

Short answer is: You can't. That's why you shouldn't try to do such a silly thing.
The longer answer is: You have to put up with the delayed response of a session timeout. That could be a significant amount of time. In Global.asax there is an event called Session_End, which you can hook to do what you want.. but it won't show when the user closed their browser. It will only fire when the session has ended, which by default is 20 minutes after the last request. And that's only if it's an in-memory session and the process hasn't crashed.
The better solution is to just run a job every so often to clear the users online table. That solves the problem regardless, but requires more work for your job to figure out what to remove.

In your Global.asax.cs, you can code that in the Session_End event. It will not happen till the session timeout (default 20 minutes), but it will happen. You will likely want to delete any existing records on Application_Start and/or Application_End events (the Application_End event does not execute when the computer or web process crashes so best to use Application_Start) to make sure you start off fresh when the web application loads.

You can use the Event Session_End in the Global.asax.
There may be a delay between the browser closing and the actual session timeout on the server depending on your session settings.

I guess should be scheduled job that will close expired sessions like in AspState.
You can take a look into AspState database stored procedure DeleteExpiredSessions to see what you need to do. This procedure job with name ASPState_Job_DeleteExpiredSessions call each minute to close sessions.

Try the below code.
On the form_load event in every page, write the below code.
Response.AppendHeader("Refresh", "60; URL=../default.aspx")
Default session time out is 20 minutes and I am using "60" seconds for this demo. If there is no activity in this period of time, then it goes back to the default or home page and we send a key to update the database "session key" or any other tag. This way we can possibly know the activity of the user or member.
This worked for me.

WCF Rest Asynchronous Calling Methods

I have a class library I developed that is rather processing intensive that I currently call through a WCF REST service.
The REST service directly accesses the DLLs for the class library and more or less the WCF rest service is an interface for the system.
Let's say the following methods are defined:
Create Request
Starts a thread that takes five minutes, but immediately returns a session ID that the process generates and the thread uses to report when it is completed to the database.
Check Status
Accepts a session id and checks the database to see if the process has completed.
I have to think that there is a better way to "manage" the threads running, however, my requirements state that the user should receive an immediate response from the REST service upon issuing a request.
I am using the WCF Message property to return XML to the browser and as this application can be called from any programming language I can't use classic WCF and callbacks (I think, correct me if I am wrong).
Sometimes I run into an issue where an error occurs and the iscomplete event never gets written to the database and therefore the "Check Status" method says it's processing forever.
Does anyone have any ideas about what is normally done and what can be done in this situation?
Thanks!
Jeffrey Kevin Pry

Your service should return a 202 Accepted at the initial request with a way for the client to check the current status, either through the Location header or as part of the content.
As you indicate the client then polls the URL indicated to check the current status. I would also suggest adding a bit of cache time to this response in case a client just starts looping.
How you handle things on the server is up to you and in no way related to REST. For one thing I would put all logic that executes as the background thread in a try/catch to you can return an error status back if an error occurs and possibly retry the action depending on the circumstances.

I implemented a similiar process for importing/processing of large files and to be honest, I have never had a problem. Perhaps resolving the reason that the IsComplete never gets set will make this more resilient.
Not much of an answer, but still..