Click here to Skip to main content
15,938,578 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
I am not able to increase the session timeout more than 20 minutes in ASP.NET Core 6.0. Session gets expired after every 20 minutes not in debug mode but in IIS (Hosted after publish),For load balancing the application is hosted on 2 server and use AddDistributedMemoryCache property.
Session changes are done in Application side as well as IIS side also.
Below are the changes done for increase session time to 40 minutes in ASP.NET Core 6.0.

What I have tried:

# **1.Application Changes**

------------------------------ Program.cs ----------------------------------------


string sessionTimeout = Convert.ToString(config.GetSection("AppSettings").GetSection("SessionTimeout").Value);
int sessiontime = int.Parse(sessionTimeout);
builder.Services.AddSession(options =>
    options.IdleTimeout = TimeSpan.FromMinutes(sessiontime);
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.Cookie.SameSite = SameSiteMode.Strict;

if (config.GetSection("AppSettings").GetSection("Envoirnment").Value != "Development")


"AppSettings": {
    "SessionTimeout": "40"

 Added Microsoft.AspNetCore.Session Package in application and also add below code .csproj file  of the application.
    <PackageReference Include="Microsoft.AspNetCore.Session" Version="2.2.0" />

# **2.IIS Changes**

I.Changes server and application both session timeout to 40 mins.
II.Set idle timeout to 40 minutes in application pool properties/performance for both end ( server and application).

# **2.web.config Changes**

    <pages viewStateEncryptionMode="Always" /> 
   <customErrors defaultRedirect="Error.aspx" mode="RemoteOnly" />
        <httpRuntime enableVersionHeader="false" requestPathInvalidCharacters="<,>,",',&,*,%,:,\" />
        <httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="Strict" domain="" />
           <sessionState  mode="InProc"  timeout="40"  />
    <!--<machineKey validation="AES" />-->  

I  am still getting a session timeout at 20 minutes. Is there anything else I need to do?
Updated 9-Mar-23 22:09pm

1 solution

Check the hosting service: they can override session length requests, and set their own maximum value. Try reducing the session timeout and see if that is obeyed. If it is, it's probably host settings that you can't override.

Some (mostly the free or really cheap ones) will even limit session to 5 minutes!
Share this answer

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900