ASP.NET会话持久化问题求助：需保持会话至用户主动注销

安全阿岳

2026-5-15

Session Persistence Problem: Forms Auth Isn't Redirecting Automatically, Manual Page_Load Checks Are Required

Hey there, I get how frustrating it is when session management doesn't behave like it's supposed to. Let me walk through what's going on here and the fixes you can try:

First off, right now I'm forced to add this check in every page's Page_Load event just to stop the site from breaking:

if (string.IsNullOrEmpty(Session["Postion"] as string)) { 
    Response.Redirect("Login.aspx"); 
}

The goal is to keep sessions active until the user logs out on their own, but none of the fixes I've tried have stuck. Even when I remove that manual check, my Web.Config is supposed to auto-redirect to Login.aspx when sessions expire—but that's not happening at all.

Here's the full content of my Web.Config for reference:

<configuration> 
  <configSections> 
    <sectionGroup name="devExpress"> 
      <section name="themes" type="DevExpress.Web.ThemesConfigurationSection, DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49a" requirePermission="false"/> 
      <section name="compression" type="DevExpress.Web.CompressionConfigurationSection, DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49a" requirePermission="false"/> 
      <section name="settings" type="DevExpress.Web.SettingsConfigurationSection, DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49a" requirePermission="false"/> 
      <section name="errors" type="DevExpress.Web.ErrorsConfigurationSection, DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49a" requirePermission="false"/> 
      <section name="resources" type="DevExpress.Web.ResourcesConfigurationSection, DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49a" requirePermission="false"/> 
    </sectionGroup> 
  </configSections> 
  <system.web> 
    <httpRuntime maxRequestLength="2048"/> 
    <compilation debug="true" targetFramework="4.0"> 
      <assemblies> 
        <add assembly="System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A"/> 
        <add assembly="System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/> 
        <add assembly="DevExpress.Dashboard.v17.1.Web, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Dashboard.v17.1.Core, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.DataAccess.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Data.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Office.v17.1.Core, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.PivotGrid.v17.1.Core, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Web.Resources.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Printing.v17.1.Core, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.XtraReports.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Charts.v17.1.Core, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Xpo.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.RichEdit.v17.1.Core, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Pdf.v17.1.Core, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/> 
        <add assembly="DevExpress.Web.Bootstrap.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A"/>
      </assemblies> 
    </compilation> 
    <authentication mode="Forms"> 
      <forms name="MyAuth" timeout="7000000" protection="All" loginUrl="~/Login.aspx" slidingExpiration="true"/> 
    </authentication> 
    <pages validateRequest="false"> 
      <controls> 
        <add tagPrefix="asp" assembly="DropDownListChosen" namespace="DropDownListChosen"/> 
      </controls> 
    </pages> 
    <httpModules> 
      <add type="DevExpress.Web.ASPxHttpHandlerModule, DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49a" name="ASPxHttpHandlerModule"/> 
    </httpModules> 
    <httpHandlers> 
      <add type="DevExpress.Web.ASPxHttpHandlerModule, DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49a" verb="GET" path="DX.ashx" validate="false"/> 
    </httpHandlers> 
  </system.web> 
  <connectionStrings> 
    <remove name="LocalSqlServer"/> 
    <add connectionString="Data Source=167.114.12.244;Initial Catalog=Wash;Integrated Security=False;User ID=BeljWash;Password=A100310021001a;Connect Timeout=15;Encrypt=False;Packet Size=4096;user instance=False " name="ConnectionString"/> 
  </connectionStrings> 
  <system.webServer> 
    <modules> 
      <add type="DevExpress.Web.ASPxHttpHandlerModule, DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49a" name="ASPxHttpHandlerModule"/> 
    </modules> 
    <validation validateIntegratedModeConfiguration="false"/> 
    <handlers> 
      <add type="DevExpress.Web.ASPxHttpHandlerModule, DevExpress.Web.v17.1, Version=17.1.3.0, Culture=neutral, PublicKeyToken=b88d1754d700e49a" verb="GET" path="DX.ashx" name="ASPxHttpHandlerModule" preCondition="integratedMode"/> 
    </handlers> 
  </system.webServer> 
  <devExpress> 
    <themes enableThemesAssembly="true" styleSheetTheme="" theme="" customThemeAssemblies="" baseColor="" font=""/> 
    <compression enableHtmlCompression="false" enableCallbackCompression="true" enableResourceCompression="true" enableResourceMerging="true"/> 
    <settings accessibilityCompliant="false" bootstrapMode="Bootstrap3" doctypeMode="Html5" rightToLeft="false" checkReferencesToExternalScripts="true" protectControlState="true" ieCompatibilityVersion="edge"/> 
    <errors callbackErrorRedirectUrl=""/> 
  </devExpress>
</configuration>

Troubleshooting Steps & Fixes

1. Separate Forms Auth and Session Timeouts

First, a critical point: Forms Authentication cookies and Session State are completely independent. Your Forms Auth is set to a wild timeout="7000000" (over 800 days), but by default, Session State times out after 20 minutes. That means even if the auth cookie is still valid, the session will die first, making Session["Postion"] null.

Fix this by adding a <sessionState> section inside <system.web> to align the timeouts (or pick a more reasonable value):

<sessionState mode="InProc" timeout="7000000" />

Pro tip: That 800-day timeout is way too long for production. Stick to something like 120 minutes and let slidingExpiration="true" extend it as the user interacts with the site.

2. Enforce Authorization Rules

Your Web.Config is missing an <authorization> section to block anonymous users from accessing protected pages. Add this inside <system.web>:

<authorization>
  <deny users="?" /> <!-- Block unauthenticated users -->
  <allow users="*" /> <!-- Allow authenticated users -->
</authorization>

This should trigger the auto-redirect to Login.aspx without needing your manual Page_Load check.

3. Check for DevExpress Module Interference

DevExpress's HTTP handler module might be messing with the auth redirect flow. Try temporarily commenting out the DevExpress entries in <httpModules> (for IIS classic mode) and <modules> (for IIS integrated mode) to see if the auto-redirect starts working. If it does, check DevExpress's docs for v17.1 auth compatibility issues, or apply the latest patch for that version.

4. Validate Login Page Logic

Make sure your Login.aspx is properly setting the auth cookie after validating credentials. You should have something like this in your login submit code:

if (/* credentials are valid */)
{
    FormsAuthentication.SetAuthCookie(username, rememberMe);
    Response.Redirect("Default.aspx");
}

Without this, the Forms Auth system won't recognize the user as authenticated.

5. Test with a Shorter Timeout

That 7000000-minute timeout is so long it's hard to test if expiration works. Temporarily set it to 5 minutes, wait it out, and see if the auto-redirect kicks in. This will help you rule out issues with the extreme timeout value.

内容的提问来源于stack exchange，提问作者Ahmed Hassan