Session Var

Ok, i made a gaming clan website. It has a login that uses session vars to store the username and pwd. I am experiencing an issue of logging out.

Does the time out mean time from creation?, like 20 min after the var is created, it kills it.

How do i keep the session var open while the person is on the site.session variables are active for the time that a person is on the site and is actively viewing (interacting with the server) the site.

If a person does not send any information back to the server within 20 minutes then their session variable expires. If they interact with the server (clicking on a link, posting a form etc) then their session variable is kept alive until the time they explicitly logout (Click on a logout button), close the browser or do not interact with the server for the default session timeout time..

hth
Cheers
MarkusJ
thats what i have heard but... it like isn't true for my case for some reason, cause i could be surfing around logged in and i will get logged out all of the sudden. I also have a page that refreshes its self every 5 min on a very small frame on the left bar...
Are you using frames/ pop up windows?
i have 2 main frames, a leftbar and a main window. Then i have the refreshing frame in the leftbar frame.
AFAIK there are some issues with frames and session variables

A quick search of the newsgroups reflects this

http://tinyurl.com/ifiw

Cheers
MarkusJ
that is only for ie below 5.5

and i don't really lose them between frames, they just die after 20 min, even if the person is active.
You should be using a different way to authenticate users like form. Holding the log in values in session variables isn't the way to do it. MS provided a couple different authentication methods, and they are full featured and quite good at what they do. You can use Windows, Forms, Passport or None (which is what you are doing). You should be using Forms authentication if you want to handle the authentication through code. Lethal posted some good authentication code at this link:
http://www.vbforums.com/showthread.php?s=&threadid=245643
Indeed,

like hellswraith said you ... There are other sorts of authentication. Session variables are very good to keep data in memory for a short time.
Use an authentication ticket

Dim objTicket As FormsAuthenticationTicket = New FormsAuthenticationTicket(1, Username, DateTime.Now, DateTime.Now.AddMinutes(60), False, String.Join("|", varRole))

1,
Username,
DateTime.Now,
DateTime.Now.AddMinutes(60), <<< EXPIRE DATE
False,
String.Join("|", varRole))

u can find full code for using the ticket in post http://www.vbforums.com/showthread.php?s=&threadid=257238

Session Variable

I have an application where the default page requires the user to choose the location they are logging into. I take the value (one or two letter designation) and save it to a Session variable. I then access this variable on the page load of all pages in the application and use the value to call stored procedures to display the proper data from the database. The problem is, some users are timing out and lose their session causing them to have to go back to the first page and re-choose their location. I did increase the session timeout to 60 but this may still not be long enough for some users. Is there a better way to do this without using a session variable? Any help and/or example VB code will be appreciated.

Thanks

While navigating to other page assign this value to a hidden field. Then afterwards check the value of hidden field instead of Session variable. Once you are navigating to another page transfer this value in hidden field again to Session.

Let me know if you need any further help

Any session var or app var would be subject to a session timeout. You do not want to extend the timeout too much because it has an adverse effect in resource consumption.

If your security requirements are not too stringent (risk is low), you could use a QueryString (URL) parameter instead. Validate the parameter to make sure nothing fishy comes in before you use it. You could keep the info in a user database and get the data from there when the user first logs in.

Forgot: You could also use Hidden fields (if security is not stringent) or cokkies if accepted in your client browsers.

See:http://msdn2.microsoft.com/en-us/library/z1hkazw7.aspx

I tried the suggestion and am now running into a problem. It works great if the user stays on the same page. The problem is when the user clicks on another page using the link buttons I provide. If the session expires then my variables are not set. I was hoping to set the Session Variables again when the user leaves the page but I'm not sure where to do this. Any more ideas?

What I would recommend is that you use a cookie for your application with a time-out of however many minutes you think you need. Each page would then check the cookie to get the values needed. With those wonderful people, such as myself, that don't allow most cookies, you can always make the page auto-refresh every x number of minutes. That should reset the timer on the session variable. You will have the problem of needing to make sure that data is not resubmitted. Web applications have the drawback of not automatically trusting the user the way a desktop application would.