Bug 20538 - ASP.NET session does not timeout based on value in web.config
Summary: ASP.NET session does not timeout based on value in web.config
Status: NEW
Alias: None
Product: Class Libraries
Classification: Mono
Component: System.Web ()
Version: 3.2.x
Hardware: Macintosh Mac OS
: --- normal
Target Milestone: Untriaged
Assignee: Bugzilla
Depends on:
Reported: 2014-06-11 15:23 UTC by Dhruv Chopra
Modified: 2017-02-15 17:57 UTC (History)
4 users (show)

Is this bug a regression?: ---
Last known good build:

Notice (2018-05-24): bugzilla.xamarin.com is now in read-only mode.

Please join us on Visual Studio Developer Community and in the Xamarin and Mono organizations on GitHub to continue tracking issues. Bugzilla will remain available for reference in read-only mode. We will continue to work on open Bugzilla bugs, copy them to the new locations as needed for follow-up, and add the new items under Related Links.

Our sincere thanks to everyone who has contributed on this bug tracker over the years. Thanks also for your understanding as we make these adjustments and improvements for the future.

Please create a new report for Bug 20538 on GitHub or Developer Community if you have new information to add and do not yet see a matching new report.

If the latest results still closely match this report, you can use the original description:

  • Export the original title and description: GitHub Markdown or Developer Community HTML
  • Copy the title and description into the new report. Adjust them to be up-to-date if needed.
  • Add your new information.

In special cases on GitHub you might also want the comments: GitHub Markdown with public comments

Related Links:

Description Dhruv Chopra 2014-06-11 15:23:35 UTC
I have created a very simple ASP.NET web application in Xamarin Studio and set the timeout of the sessionState to 1.
The first time i load the page, I get a new session.
The second time i load the page, and if its after 1 min, I get a new session.
But from the third time onward, irrespective of how many minutes i wait, I always get the same session.

My default.aspx:
<%@ Page Language="C#" Inherits="sessionTesting.Default" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<head runat="server">
	<form id="form1" runat="server">
		<asp:Button id="button1" runat="server" Text="Click me!" OnClick="button1Clicked" />
		<asp:Label id="lable1"  runat="server" Text="SessionId" />

using System;
using System.Web;
using System.Web.UI;

namespace sessionTesting
	public partial class Default : System.Web.UI.Page
		public void Page_Load (object sender, EventArgs e)
			lable1.Text =  this.Context.Session.SessionID+" "+DateTime.Now.ToString() + " "+this.Context.Session.IsNewSession.ToString();

		public virtual void button1Clicked (object sender, EventArgs args)
			button1.Text = "You clicked me";

<?xml version="1.0"?>
Web.config file for sessionTesting.

The settings that can be used in this file are documented at 
http://www.mono-project.com/Config_system.web and 
    <compilation defaultLanguage="C#" debug="true">
    <customErrors mode="RemoteOnly">
    <authentication mode="None">
      <allow users="*" />
    <!--<trace enabled="false" localOnly="true" pageOutput="false" requestLimit="10" traceMode="SortByTime" />-->
    <sessionState mode="InProc" cookieless="false" timeout="1" />
    <globalization requestEncoding="utf-8" responseEncoding="utf-8" />
    <pages enableSessionState="true">

csproj file:
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
    <Reference Include="System" />
    <Reference Include="System.Web" />
    <Reference Include="System.Xml" />
    <Reference Include="System.Web.Services" />
    <Content Include="Global.asax" />
    <Content Include="web.config" />
    <Content Include="Default.aspx" />
    <Compile Include="Global.asax.cs">
    <Compile Include="Default.aspx.cs">
    <Compile Include="Default.aspx.designer.cs">
  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
  <Import Project="$(MSBuildExtensionsPath)\Microsoft\VisualStudio\v10.0\WebApplications\Microsoft.WebApplication.targets" />
      <Properties VerifyCodeBehindFields="True" VerifyCodeBehindEvents="True">
        <XspParameters Port="8080" Address="" SslMode="None" SslProtocol="Default" KeyType="None" CertFile="" KeyFile="" PasswordOptions="None" Password="" Verbose="True" />

Using Xamarin on OSX:
Xamarin Studio
Version 5.0.1 (build 3)
Installation UUID: 977065ba-3b1e-4f4e-84a7-4ee00ed21bca
	Mono 3.2.6 ((no/9b58377)
	GTK+ 2.24.23 (Raleigh theme)

	Package version: 302060000

Not Installed

Apple Developer Tools
Xcode 5.1.1 (5085)
Build 5B1008

Not Installed

Xamarin.Mac: Not Installed

Build Information
Release ID: 500010003
Git revision: f94ee866936d25105704eb63728ad5a981eda0a4
Build date: 2014-06-04 12:19:12-04
Xamarin addins: 1a6044e8321ea07e03a56b5381951686c82fed8b

Operating System
Mac OS X 10.9.3
Darwin Dhruvs-Mac-Book-Pro.local 13.2.0 Darwin Kernel Version 13.2.0
    Thu Apr 17 23:03:13 PDT 2014
    root:xnu-2422.100.13~1/RELEASE_X86_64 x86_64
Comment 1 Michael Thwaite 2014-09-09 15:34:44 UTC
+1 On Linux (Ubuntu 14.04LTS).

Mono 3.2.8, XSP/mod_mono 3.0.0

I have sessions building but never ending. This is resulting in mod_mono memory increasing quickly to 3GB where performance falls off and ultimately, it fails completely at about 3.8GB.

Is there any work around to maybe terminate stale sessions some other way or manage collection of those sessions?

Comment 2 Michael Thwaite 2014-09-11 06:43:46 UTC
After a week of trying different web server configurations, XSP, etc., I was able to stem the leak significantly by clearing out session variables each time a new session started with this code at the end of the Session_Start event:

			try {
				if (HttpContext.Current.Cache ["Sessions"] == null)
					HttpContext.Current.Cache ["Sessions"] = new List<HttpSessionState> ();

				List<HttpSessionState> Sessions = (List<HttpSessionState>)HttpContext.Current.Cache ["Sessions"];

				List<HttpSessionState> SessionsToGo = new List<HttpSessionState> ();

				DateTime oldSession = DateTime.Now.AddMinutes (c.SessionTimeoutMins); // = -30

				#if (DEBUG)
				oldSession = DateTime.Now.AddMinutes (-1); //for testing

				//Kill old sessions
				Sessions.ForEach (session => {

					if (session != null) {

						if (session ["LastAccess"] != null) {
							DateTime LastAccess = (DateTime)session ["LastAccess"];

							if (LastAccess > DateTime.MinValue && LastAccess < oldSession) {

								//Add reference to SessionsToGo
								SessionsToGo.Add (session);

								session.Clear (); //die

								session.Abandon (); //die - this doesn't seem to work though

				//Remove from collection
				SessionsToGo.ForEach (session => Sessions.Remove (session));

				SessionsToGo = null; //hint to the GC!

				//add this session
				Sessions.Add (HttpContext.Current.Session);

				LogEntry.Write ("Session count:" + Sessions.Count.ToString (), 1019);
			} catch (Exception ex) {
				LogEntry.Write ("Session count/manager suffered an error: " + ex.InnerException.Message, 1019, System.Diagnostics.EventLogEntryType.Warning);
Comment 3 Player701 2017-02-15 17:57:47 UTC
This bug is still present... confirmed on FreeBSD / mono 4.6.2 / mod_mono 3.12. Our simple web app uses ASP.NET sessions to store some data there. Sessions start but never end, and in just a few hours after regular checks by an outside monitoring system (a check is an HTTP request, which triggers a session to start) the server slows down to a crawl!

We would not like to use any kind of workaround because everything works as it should on Windows, so it's Mono's fault. Please fix this bug if possible. Thank you very much.