Aspnet unexpected logout

Question

I'm working in a project where we are using aspnet mvc 5 and we have some problems with a unexpected logout after 5 min of inactivity in a page.

I have this in my web.config:

<sessionState timeout="30"/>
<authentication mode="None"/>

What you think are causing this about project?

If need more information ask please.

Thanks.

PS: My AuthenticationType is ApplicationCookie

PS2: Added machine key to web.config and still logout after a couple of minutes:

<machineKey validationKey="string" decryptionKey="otherstring" validation="SHA1" decryption="AES" />

PS3: Locally everything works fine.

Answer 1

Please extend your application pool timeout. It would solve the problem as from config posted, your website is using Session InProc Mode, the default one.

Once the application recycled, your information stored in w3wp process would be gone.

Since you are using cloud services, you might also want to check how the load balancing works.

If they are not using sticky session, best is you change your session mode as well to StateServer or SQLMode.

Hope it helps. Let me know the result. Thanks

Answer 2

SessionState timeouts have nothing at all to do with login timeouts. The users information for a login is stored in an encrypted cookie. Based on what you said your Authentication Type is, you need to change the setup of your ASP Identity in the StartUp class.

app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            LogoutPath = new PathString("/Account/Logout"),
            //Here is where you tell the system how long someone can stay logged in
            //while being inactive.
            ExpireTimeSpan = System.TimeSpan.FromMinutes(60),

            SlidingExpiration = true,
            CookieName = "LoginCookie"
        });

Edit

Given that you are hosting on a cloud service, you are most likely not sitting on a single server, but rather your application is deployed to multiple servers behind a load balancer which directs request to multiple machines. When you are not guaranteed to be on a single server, you need to define the MachineKey in your web.config. This key is what is used to encrypted/decrypt the LoginCookie. If the MachineKey is not defined, IIS makes one up. When on multiple servers, each server in that case would have its own MachineKey. Since the keys are different, they cannot decrypt each others login cookies and thus, they think you are not logged in.

    <system.web>
        <machineKey validationKey="BigLongNumber" decryptionKey="DifferentBigLongNumber"
validation="SHA1" decryption="AES" />
    </system.web>

Machine Key Generator