IIS 默认超时
我知道以下步骤允许我在 IIS 中配置超时值，但是它们之间有什么区别。默认情况下，web.config 文件中还有 ASP.NET Session State 和 CookieTimeout 值，因为我在配置编辑器中没有看到它们。如果是这样，我需要对 web.config 文件进行哪些更改？它如何影响其他超时更改？
步骤
- 默认情况下，会话超时为 20 分钟。该值受影响于 许多设置，包括应用程序池、ASP、ASP.NET 会话状态、Cookie 超时。
- 打开IIS管理器
- 应用程序池->高级设置->流程模型->设置空闲 超时（分钟）
- 站点 ->你的网站域名.com -> ASP->会话属性 -> 超时然后应用更改
- 站点 ->你的网站域名.com ->配置编辑器-> system.web/sessionState ->设置超时值然后应用更改
- 站点 ->你的网站域名.com ->配置编辑器-> system.web/roleManager =>设置 cookieTimeout 然后应用更改
I am aware that the following steps allow me to configure the timeout values in IIS however what are the differences between them. Also are the ASP.NET Session State and CookieTimeout values in the web.config file by default as I don't see them in the Configuration Editor. If so what change do I need to make to the web.config file and how does it affect the other timeout changes?
Steps
- Session Time Out is 20 minutes by default. The value is affected in
a number of settings including Application Pool, ASP, ASP.NET
Session State, CookieTimeout. - Open IIS Manager
- Application Pool -> Advanced Settings -> Process Model -> Set Idle
Time-out in minutes - Sites -> your-website-domain.com -> ASP -> Session Properties ->
Time-out then Apply Change - Sites -> your-website-domain.com -> Configuration Editor ->
system.web/sessionState -> Set Timeout value then Apply Change - Sites -> your-website-domain.com -> Configuration Editor ->
system.web/roleManager => Set cookieTimeout then Apply Change
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
当应用程序池超时后，应用程序池被回收。如果您使用默认的 InProc 会话存储，则超时到期后所有会话都会丢失。一般来说，每次有人从应用程序请求页面时，超时都会重置。
会话状态超时是会话存储中会话的过期时间。当超时到期时，会话信息将从会话存储中删除，并调用 Session_End。请参阅该元素的文档，可以在此处找到该文档。
您提到的 Cookie 超时是角色管理器用于在 cookie 中缓存用户角色的 cookie 的到期时间。属性cacheRolesInCookie 还必须设置为true 才能生效——默认值为false。请参阅此处的文档。
我不认为会话状态或 cookie 超时默认包含在配置文件中，但这取决于生成配置文件的内容。如果您希望会话保持更长时间的打开状态，则只需设置 system.web/sessionState 即可，只要您的网站有足够的流量来防止应用程序池回收（每 20 分钟点击一个页面）。由于应用程序池回收还有其他原因，因此使用除 InProc 之外的其他存储机制之一可能是个好主意。如果您使用其中一个身份验证提供程序，则可能会有额外的超时。我知道表单身份验证有一个您也想设置的超时。
When the application pool timeout expires, the application pool is recycled. If you're using the default InProc session store, all sessions are lost when the timeout expires. In general, the timeout is reset every time someone requests a page from the application.
The Session State timeout is the expiration of the session in the session store. When this timeout expires, the session information is removed from the session store and Session_End is called. Refer to the documentation for the element, which can be found here.
The Cookie Timeout that you mention is the expiration for the cookie used by role manager to cache the user's roles in a cookie. The attribute cacheRolesInCookie also has to be set to true for this to have an effect-the default is false. Refer to the documentation here.
I don't believe session state or cookie timeout are included in the configuration file by default, but it depends on what generated the configuration file. If you're looking to have sessions stay open longer, you should only have to set system.web/sessionState so as long as your site has enough traffic to keep the app pool from recycling (one page hit every 20 minutes). Since there are other reasons for the app pool recycling, using one of the other storage mechanisms other than InProc may be a good idea. If you're using one of the authentication providers, it may have an additional timeout. I know that forms authentication has a timeout that you would want to also set.