Session.timeout and sessionID confusion

[jsteph]

Hello,
In our little intranet site, I set a session.timeout of 60, which should be an hour. What seems to be happening is one of two things--either the session is timing out before 60min and autostarting a new session, or the user has somehow gotten another sessionid via normal navigation within the site.

In simplest terms, I have page1.asp, which has a button on it, and via javascript it calls page2.asp, passing session.sessionID as one of the querystring variables, calling it page1session.

In Page2.asp, I compare as follows:
IF request("page1session") <> session.sessionid then
[some code that writes an error log]
End If

That error log occasionally has items in it. The timestamp I write in the logfile shows as less than an hour from the timestamp in the log I had written in the session_onstart of page1.

So...why would either page1 or Page2 have a different session? How can that happen?
Thanks,
--Jim

 

[Sheco]

Perhaps the user has not accepted your session cookie.

 

[jsteph]

Sheco,
But I've been logging everything, ie, not just when the sessionid's don't match--I have a log written, for testing, that writes the session id's as well as the request-variable session id's, and they show up fine and equal--for about 20 min, then there's a new sessionid. This user is not opening up a new explorer window--I made sure of that.

It just seems like the session is dying prematurely, and it just up and starts a new session with a new id when it calls page2.asp, now page2's sessionid is out of sync. So it seems like the .timeout property is not working. I am setting it in the session_onstart. Is that too late--ie, the session's already began and that property can't be reset in that function? Should I set it in the Application_onstart?
Thanks,
--Jim

 

[guitardave78]

Are you on a load balanced set up.
What happens is the server load is shared between processors / servers. If one server is overloaded it switches to a new server to give you the page, but you lose the session if the host is not set right.

Look in to Isolation Mode and Web Gardens

http://support.microsoft.com/kb/822171

}...the bane of my life!

http://www.yetanotherreviewsite.co.uk

http://www.fuzzyd.co.uk

 

[jsteph]

No...it's just the one server. I think it may be the application pool--I checked and it had a 10 min timeout for the pool, which I'm assuming overrides the session.timeout. I changed the pool timeout to 60 min, I'll see what happens,
--Jim

 

[guitardave78]

fair enough

}...the bane of my life!

http://www.yetanotherreviewsite.co.uk

http://www.fuzzyd.co.uk

 

[nicklieb]

yep the IIS settings overrides any programitical change to session timeout. Default is 20 mins.

What maybe worth looking into is using a cooking to store a key to a user.