Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Different session time out for different users

Is it possible to have different session time outs for different users? I need to have 180 mins session for admin and 20 min for non-admin users. Currently it is single session timeout for all the users. we are using a web.config key

Any help would be appriciated.

like image 610
user1787578 Avatar asked Oct 31 '12 05:10

user1787578


People also ask

What is the recommended session timeout?

“OWASP recommends application builders to implement short idle time outs (2-5 minutes) for applications that handle high-risk data, like financial information. It considers that longer idle time outs (15-30 minutes) are acceptable for low-risk applications.”

What is the difference between session timeout and idle timeout?

The course idle time out works in-conjunction with session timeout length. When the user's session is about to expire, the system displays a warning message: If the user chooses to continue their session, then the timer is reset. The user can continue completing their training and remain logged in to the system.


1 Answers

Setting Session.Timeout property by code will set the timeout on a per user basis.

You can manually set Session.Timeout = 20; or Session.Timeout = 180; based on the user type when they log in.

This code should work for you:

protected void SetSessionTime(string userType)
{
    if (UserType == "admin")
    {
        Session.Timeout = 180;
    }
    else
    {
        Session.Timeout = 20;
    }
}

You can call SetSessionTime() after user successfully logs in.

like image 58
Learning Avatar answered Sep 28 '22 02:09

Learning