Category Archives: IIS

Session randomly expiring


I had just deployed a new website to my production server running IIS. The client was testing, but complained that the session was timing out too soon.

The website was using a check on session variables to see if the user was logged in and the session was still valid , something like this

 if (Session[“CustomerID”] == null)
                Response.Redirect (“~/SessionExpired.aspx”);

On testing myself it seemeed the session data was randomly expiring. In the development environment there was no problem. I checked the usual culprits: session timeouts in the web.config, IIS session settings, if the anti-virus was touching certain config files etc. No luck…

Then I noticed that the application pool under which the website was running was set to allow 2 worker processes! aha!


According to the MS documentation “The in-process session state mode stores session-state data for an ASP.NET application in the worker process where the application runs. This mode is the default for IIS 7.”

The user would login successfully, session data would be stored under that workerprocess. BUT because of the whole http is stateless thing, the user could be randomly swapped to the other workerprocess, which has no knowledge of their previous session data. As the session data was no longer present, my code would inform them their session had expired.

I’m not sure why the pool had 2 workerprocesses allowed, but after setting it to the default of 1, the problem was resolved.

If you’re working with a web-farm or some such dealing with multiple processes then their are alternatives to the InProc sessionstate mode, such as using a SQL server or the ASP.NET State Server service to store session data.