Common solutions to sessions dropping in asp.net

Over the years I’ve had a number of issues with various Asp.net applications dropping their session state when they shouldn’t have and these are the list of common fixes I’ve used to fix them.

Basically their are three different locations that I check first when diagnosing dropping sessions.

  1. The web.config file session setup line sessionstate.
  2. The application pool recycling while using InProc mode.
  3. Modifications causing the application to restart


Checking the web.config file for the correct session setup.

Yes, this is the first place everyone checks but it’s important to make sure that you check all of your settings and to make sure that they are configured appropriately for your application. The first most obvious place to check is the timeout value in the sessionstate tag, this needs to be set to an appropriate value. The other thing to check with this tag is the mode that you are using to store that session information. I’m not going to go into every different mode with this article, since its been covered a number of times before but some modes offer a lot more reliability than others. The SQLServer mode is supposed to be the most reliable of the modes, but I’ve yet to have a problem with the StateServer mode. I have however had numerous problems with sessions dropping with the InProc mode and I don’t recommend using it at all.

For more information on what settings are available in the sessionstate and the trade offs involved with the different modes check here and here.

The application pool recycling timeout, if your using the InProc mode.

Now this next area is not an obvious one, but it will sometime catch you if you have an application with a very high session timeout and it’s using the Inproc mode. Each application within IIS has its own application pool where the memory and process space for the application resides. But when a worker process within the application is detected as idle it can be shutdown and this will cause session information to be lost for a user who’s been idle for that long. In other words if you have a user who’s idle in the application their worker process can be shutdown taking their session information with it. So if you are using the Inproc mode for your sessionstate you will need to make sure that the Idle timeout for the worker process is set the same as your timeout in the web.config. You can see a picture of the idle timeout below has shown in IIS 6

Application pool timeout setting

Be careful doing this though, bumping up this idle timeout for too long can cause performance issues with IIS if your not careful. Personally, I think this is another good reason to use the other modes to store your session and not use InProc.

Modifications causing the application to restart

This is another gotcha which I’ve seen once or twice. There are a number of changes that can occur which will cause an application to restart which causes the loss of session information.

Here are a list of the changes that I know of which can cause an application to restart:

  • Changes occurring in global.asax, machine.config or web.config in the application root, or in the Bin directory or any of its subdirectories
  • Changes occurring to the settings to the application pool in IIS.
  • Changes occurring in the code-access security policy file.
  • Restarting IIS.

Also some virus scanners will sometimes cause IIS to think that the files listed above have been changed inadvertently causing an application to restart.

Your thoughts?

These are some of the issues I’ve found in the past, but are there any others that I’ve missed or not come across? Or am I wrong about something in this article? If so please feel free to leave a comment below.

Mike GriffithCommon solutions to sessions dropping in asp.net