ASP.NET Session Timeout Testing

Question

I'm a doing some blackbox testing of a ASP.Net website and I need to test different session timeout scenarios.

I'm not sure they fully encapsulated session timeouts. Other then leaving a page open for 20 minutes is there an easier way to force a session timeout?

Answer 1

You can change the timeout in your webconfig

 <authentication mode="Forms">
      <forms timeout="10" protection="All" slidingExpiration="true" loginUrl="~/login.aspx" cookieless="UseCookies"/>
 </authentication>

Answer 2

Recycle the app pool on the server.

Answer 3

Bounce the AppPool and session will be lost.

if you don't have direct IIS access, you can open and save Web.Config to do the same thing (Don't use notepad, it screws up the encoding).

Answer 4

Make a shorter timeout.

Answer 5

The easiest way would be to open the page in two different tab and logout at other tab would automatically expire session in first tab. Most of the browsers share session across the tab. So i find it very easy without modifying anything in web.config. This way you could test even if a particular feature is not handling redirect to login when session expires.

Answer 6

If you are storing your session information in a cookie, you could try deleting your cookies.