locked
Why does the Identity session not time out when a SSRS reports is showing? RRS feed

  • Question

  • User-609535877 posted

    I implement a WebForm application using default Identity and OWIN to log in on Visual Studio 2015. In following Startup class I try to timeout after idle 20 min and redirect to "/Account/Login" log on page.

    I found a interesting case when I keep a web page containing a SSRS report running, after 20 min I click any other links the session never times out and page doesn't return to log in page. But if the web page doesn't embed a SSRS report, it returns to log in page after 20 min when clicking a link.

    How to fix it to let site to time out under any cases? Thanks a lot!

                app.UseCookieAuthentication(new CookieAuthenticationOptions
                {
                    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                    LoginPath = new PathString("/Account/Login"),
                    Provider = new CookieAuthenticationProvider
                    {
                        OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                            validateInterval: TimeSpan.FromMinutes(10),
                            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager)),
                    },
                    SlidingExpiration = true,
                    ExpireTimeSpan = TimeSpan.FromMinutes(20)
                });

    For report tag

    <rsweb:ReportViewer ID="rptViewer" runat="server" ProcessingMode="Remote" CssClass="repViewer" Width="100%" Height="650px" ForeColor="Black"></rsweb:ReportViewer>

    Tuesday, January 8, 2019 7:05 PM

Answers

  • User-1174608757 posted

    Hi zhao790,

     The session will not time out when you use ReportViewer to display a SSRS report .The reason for this is the ReportViewer control emits a "setTimeOut" javascript function which  will read the Session timeout value from the web.config and pings the server 1 minute before the configured value and keeps the session alive.

    For example, if the session timeout value is 5 minutes, the ReportViewer pings the server on the 4th minute. We used fidldler to verify this behavior. In addition, if we remove the ReportViewer control from the page, the sessions times out as expected.

    To solve this problem, you can  set the property 'setsessionalive' of ReportViewer as false,then the session will time out as you wish. It shows  as below:

    <rsweb:ReportViewer ID="ReportViewer1" runat="server" KeepSessionAlive="false" ></rsweb:ReportViewer>

    Best Regards

    Wei Zhang

    • Marked as answer by Anonymous Thursday, October 7, 2021 12:00 AM
    Wednesday, January 9, 2019 3:13 AM

All replies

  • User753101303 posted

    Hi,

    Try maybe F12 Network or check the IIS log? For now my guess would be that the report viewer is perhaps doing Ajax requests which would keep the session alive ? If confirmed you would need to find out why and if it can be avoided (some kind of "auto refreshing" option ???)

    Tuesday, January 8, 2019 7:09 PM
  • User-609535877 posted

    PatriceSc, Thank so much for your response.

    I did register the AjaxControlToolKit to calendarextender a text box for data type parameter.

    Highly appreciated if you can guide me how to check the code using F12 tool or IIS log file. Thanks a lot anyway!

    Tuesday, January 8, 2019 7:35 PM
  • User-1174608757 posted

    Hi zhao790,

     The session will not time out when you use ReportViewer to display a SSRS report .The reason for this is the ReportViewer control emits a "setTimeOut" javascript function which  will read the Session timeout value from the web.config and pings the server 1 minute before the configured value and keeps the session alive.

    For example, if the session timeout value is 5 minutes, the ReportViewer pings the server on the 4th minute. We used fidldler to verify this behavior. In addition, if we remove the ReportViewer control from the page, the sessions times out as expected.

    To solve this problem, you can  set the property 'setsessionalive' of ReportViewer as false,then the session will time out as you wish. It shows  as below:

    <rsweb:ReportViewer ID="ReportViewer1" runat="server" KeepSessionAlive="false" ></rsweb:ReportViewer>

    Best Regards

    Wei Zhang

    • Marked as answer by Anonymous Thursday, October 7, 2021 12:00 AM
    Wednesday, January 9, 2019 3:13 AM
  • User753101303 posted

    So you have a confirmation but for future needs try for example https://developers.google.com/web/tools/chrome-devtools/network-performance/

    In most if not all browsers you have dev tools allowing among other things :
    - to check http request sent by the browser and the response (this is what I suggested), you can also debug Ajax calls
    - you can use the console to see possible errors (for example js errors or a function that silently fails because of a security issue)
    - inspect HTML/CSS (and even change this for testing) to diagnose a rendering issue
    etc etc...

    It's really valuable to know about those tools so that you can check what happens. You try to use them and see if you find out by yourself what zhao790 confirmed (ie the http resquest done before the session expires).

    Thursday, January 10, 2019 8:16 AM
  • User-609535877 posted

    Thank you, Zhang.

    After I changed the SSRS property KeepSessionAlive="False" the application works in different cases.

    Thursday, January 10, 2019 1:08 PM