Session Timeout in Classic ASP website

Question

Where does classic ASP store the value for session timeout? I have looked through the code and this classic ASP website isn't using Global.asa(so no "Session_OnStart") or Session.timeout=x. The website is hosted on IIS 7.On IIS for this website,in Features view,double-clicking on "ASP" -> Session Properties -> Enable session is set to 'True' and the Time-out value is set to 20. The problem is: though the session time-out is set to 20 mins. on IIS,it times out after 5 minutes. Is there any other way/place to modify the session timeout value for this classic ASP website?

Can someone help me with this please?

Edit: I looked at the settings for the application pool.The Idle time-out is 20 mins. and Recycling->Regular Time Interval is set to 1740.

Extraterrestrial

Have you also check the other recycling constraints, I tend to disable them all and use the Session timeout value in the ASP section in IIS. – Zip

@Lankymart:- All the other settings in IIS have the default values. Is there anywhere else I should be looking? – Extraterrestrial

Session timeout is fine but if any of the Application Pool Recycling settings are set they will override the Session timeout. The defaults in the Application Pool are no good and need to be changed. – Zip

I'm sorry,I dont think I know what you are talking about....The "regular time interval" under app pool->advanced settings->Recycling is set to 1740 minutes. Which setting for the app pool should I modify? – Extraterrestrial

I'm saying there is more than one Recycling setting see Configuring Recycling Settings for an Application Pool (IIS 7) - MSDN. There is at least 5 conditions that can be set and some of these are set by default. The regular time interval is just one of them, but even that should be removed. – Zip

Think about it, you want your Session to timeout every 20 minutes but you have the Application Pool regularly resetting every 29 minutes. Session timeout works differently because as soon as the session is idle (no asp activity with the server) the session timeout counts down whereas "Regular Time Interval" does what it says it just resets every 29 minutes regardless of activity. – Zip

well,I think it's 1740 minutes,which is 29 hours. My problem though,as I mentioned in the question,is the session times out after 5 mins. of inactivity.....not 20 mins. or 29 mins. or 1740 mins. – Extraterrestrial

You're right it is minutes, but my point still stands if you want it to only timeout based on the 20 minute Session Timeout you need to disable all the values in the Application Pool Recycling settings or you will still get weird behaviour with your session dropping unexpectedly. – Zip

Answer 1

Following on from my comments, your Recycling settings need to be set like the following image to make sure the Application Pool will not be reset.

It's also worth setting the "Generate Recycle Event log Entry" so you can see what events are causing your Application Pool to reset. That way you can monitor it in the Event Viewer.

---

Useful Links

• Why is the IIS default app pool recycle set to 1740 minutes? (Saturday, April 6, 2013)

Zip

Answer 2

You can do it 2 way.

1. Put global asa file into root of your site and define session time out there

2. You can introduce following line on top of each of the pages in question (if you not using include header)

   <%
      Session.Timeout=20
      Server.ScriptTimeout=1200
   %>
   

20 is been period in minutes and 1200 is same period in seconds. Keep in mind that server takes a seconds not a minutes!!! By default IIS terminates any script if it runs longer then 90 seconds.

If you using include file as a header then you will need to do it only once there, on the top of the page right after option explicit. and assuming that you already did disabled all app pool defaults as what @Lankymart suggested.

Flagwaving

There is no need to added the Session Timeout here it can be configured at the site level in IIS under the ASP -> Services -> Session Properties sub section under the heading Time-out (value is in hours, minutes and seconds). Script timeout is also found in ASP -> Behaviour -> Limits Properties under the heading Script Time-out (in hours, minutes and seconds). – Zip

Sorry I must have missed that where does he say he is a Java Developer? Plus not everyone has a site architect, I maintain web servers, sites and the underlying code that runs them. Not to mention having to be a DBA. – Zip

That's my point, it doesn't say that in "original post" and it hasn't been edited so maybe you're thinking of another question similar one you have commented on perhaps. Looking at this OP's question history I'd say he's probably more a C# developer. As for the not necessary, I'm sorry but session control should be controlled at the site level unless you have a specific requirement. It's easier to set a Session Time-out once in the IIS website configuration than having to add an #include to every page (although Session is across the site so you would only need to set Session.Timeout once) – Zip

Answer 3

In IIS7, click on your site, double click ASP, then expand the Limits Properties. You will then see a Script Time-out setting in HH:MM:SS format. Set that and it should fix things.

Source: http://technet.microsoft.com/en-us/library/bb632464.aspx

Blackstone

Answer 4

Have you looked at the web.config file? I am not a classic asp expert, but in asp.net you can also set session state in the file like so:

<sessionState mode="InProc" cookieless="false" timeout="60"></sessionState>

You may want to verify 2 things.

1.) That you app pool is not recycling too often.

2.) What I mentioned above.

Pean

Classic Asp has no web.config – Ocrea

@ShaneCourtrille not true, the <asp> section of <system.webServer> is specifically for configuring Classic ASP settings. However the example in the answer is for ASP.Net not Classic ASP. – Zip