title: MVC3 Session timeout after 10 seconds
body: <p>Need some help with a Session timeout problem in an ASP.Net web app.  Essentially the session expires about 10-15 seconds after login. </p>
  
  <p>Side Note: I use a custom combo of FormsAuthentication and basic security</p>
  
  <p>My Session.IsNewSession gets set to true after 3-4 good postbacks after login.</p>
  
  <p>My Web.Config has the following...</p>
  
  <pre><code>&lt;sessionState mode="InProc" timeout="130" regenerateExpiredSessionId="true" stateNetworkTimeout="120" compressionEnabled="true" cookieless="UseCookies" /&gt;
  &lt;authentication mode="Forms"&gt;
    &lt;forms timeout="120" ticketCompatibilityMode="Framework40" enableCrossAppRedirects="true" /&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>Where I believe the timeout refers to minutes....</p>
  
  <p>I have an MVC 3 application with an ActionFilter registered </p>
  
  <pre><code>    public static void RegisterGlobalFilters(GlobalFilterCollection filters)
      {
          filters.Add(new MyActionFilterAttribute());
      }
  </code></pre>
  
  <p>Inside the OnActionExecuting I check for a Current Session to prevent access to controller actions which an unauthorized user shouldn't be able to access.</p>
  
  <pre><code>    public override void OnActionExecuting(ActionExecutingContext filterContext)
      {            
          HttpContext ctx = HttpContext.Current;
  
          Player player = SessionHelper.GetCurrentPlayer(filterContext.HttpContext.Session);
  
          if (player == null &amp;&amp; ctx != null)
          {
              player = SessionHelper.GetCurrentPlayer(ctx.Session);
          }
  
          if (player == null ||
              (player.IsAdministrator == false &amp;&amp; player.IsCoach == false &amp;&amp; player.IsCommittee == false))
          {
              if (filterContext.Controller is HomeController || filterContext.Controller is AccountController)
              {
                  base.OnActionExecuting(filterContext);
                  return;
              }
  
              string ctxError = ctx != null ? "Context Exists" : "Context Doesnt Exist";
              string sessionError = filterContext.HttpContext.Session != null ? "filterContext.HttpContext.Session Exists" : "filterContext.HttpContext.Session Doesnt Exist";
              string requestSessionError = filterContext.RequestContext.HttpContext.Session != null ? "filterContext.RequestContext.HttpContext.Session Exists" : "filterContext.RequestContext.HttpContext.Session Doesnt Exist";
  
              throw new SecurityException(string.Format("Attempt to access {0} by user at {1} - {2} ({3}, {4}, {5})",
                                                        filterContext.HttpContext.Request.RawUrl,
                                                        filterContext.HttpContext.Request.UserHostAddress,
                                                        filterContext.HttpContext.Session,
                                                        ctxError,
                                                        sessionError,
                                                        requestSessionError));
          }
  
          base.OnActionExecuting(filterContext);
      }
  </code></pre>