Asp.Net MVC authencation with Wep Api - asp.net-mvc

Question

I am developing an MVC project with the web API. When the user logs in, I am sending a token to the web service. I keep this token in the Session object on the MVC side. If this session is null, I want to log in again from the user. But sometimes this session object is deleted by itself. What could be the reason for this?

Answer 1

Session has a timeout period of 20 minutes. It could mean that your user did not post anything back to the server within these 20 minutes.
Another problem that might cause a session timeout is if you change something in web.config or some other file through Visual Studio for example. This will trigger the compilation process in the background and will reset your session.
The default session, out of the box one, is InProc session. This means that your session is running in the same process as your web application.
If you want to preserve the session while still being able to update the web application, you need to use either Out of process or SQL Server as a session store. (Note that these session states are not really meant for the scenario where you will be updating things locally, but rather when in production and/or if you have a web farm, but nothing prevents you from using them locally.)
StateServer (out of process)
This session mode will use a service call ASP.NET State Service. This service is set to manual. You will first need to open services (click on Start -> Run -> services.msc). Find the above mentioned service, double click and change the startup to Automatic, then Start.
In your web.config you will need to update or add (if it does not exist) the following key under <system.web>:
<sessionState mode="StateServer"
stateConnectionString="tcpip=YourComputerNameGoesHere:42424"
cookieless="false"
timeout="20"/>
Update the timeout value to whatever it suits you.
SQLServer state
SQL Server state allows you to store your sessions in a designated database on your server. One thing you must remember is that this is the slowest option of all as it has to travel from server to server (in your case it might be the same server, but keep this in mind if you separate web application and sql server)
To configure SQLServer state you must perform a couple of extra steps. First, add the configuration to the web.config:
<sessionState mode="SQLServer"
sqlConnectionString="Integrated Security=SSPI;data source=MySqlServerForSessions;" />
(I cannot recall now whether you can change the name of the database, but for now work with the default values.)
The next step is to run aspnet_regsql command from your command prompt. This command should be in your C:\Windows\Microsoft.NET\Framework\vX.Y.ZZZZ (where X.Y.ZZZZ is the version of .NET Framework. Try with the highest one that you have):
aspnet_regsql.exe -S MySqlServerForSessions -E -ssadd -sstype p
This will create a new database where the sessions will be stored. If you have SQLExpress you might run into an issue when running this command. For that you need to run:
EXECUTE sp_configure 'show advanced options', 1
RECONFIGURE WITH OVERRIDE
GO
EXECUTE sp_configure 'Agent XPs', 1
RECONFIGURE WITH OVERRIDE
GO
EXECUTE sp_configure 'show advanced options', 0
RECONFIGURE WITH OVERRIDE
GO
This should help you work with the sessions. One thing to remember is that in global.asax you cannot use Session_End event when you use StateServer or SQLServer. This event triggers only for InProc session state.
For more information have a look at these two links:
ASP.NET Session State Overview
Session-State Modes
Handling Session and Authentication Timeouts in ASP.NET MVC