In web applications, session holds the information of current logged-in users. So, if the session expires in 20 minutes, then it is redirected to login page. In that case, we need to check if session exists (not null) in every action/ every controller which requires authentication.

We have to two methods to check.
  1. We can check in every ActionResult.
  2. We can check in every controller.
The first option is not good because it gets repeated every time. So, avoid it and use the second option.
We will create one custom Action Filter that handles session expiration and if session is null, it redirects to Login Action.
  1. namespace WebApplication.Filters {
  2. public class SessionTimeoutAttribute: ActionFilterAttribute {
  3. public override void OnActionExecuting(ActionExecutingContext filterContext) {
  4. HttpContext ctx = HttpContext.Current;
  5. if (HttpContext.Current.Session["userId"] == null) {
  6. filterContext.Result = new RedirectResult("~/User/Login");
  7. return;
  8. }
  9. base.OnActionExecuting(filterContext);
  10. }
  11. }
  12. }
Now, our Action Filter is created and we are ready to use it.

Apply to Controller

  1. [SessionTimeout]
  2. public class MyController: Controller {
  3. [HttpGet]
  4. public ActionResult Index() {
  5. return View();
  6. }
  7. [HttpGet]
  8. public ActionResult Home() {
  9. return View();
  10. }
  11. }
Now, all the action methods are authenticated in this Controller. So whenever a session expires, the user is redirected on the login page.

5 Comments

Join the conversation! Your thoughts help the community grow.

  • Born To Be BomPosted Dec 6, 2019, 4:24 AM

    Thank you. Additional, Login class must not be in same controller with MyController in example.

  • Baba AlexanderPosted Nov 29, 2019, 1:37 AM

    I am new in coding and i want to add a session timeout on my mvc code i cant find it anywhere they only talk of extending

  • Lu SanchezPosted May 17, 2019, 5:56 AM

    HttpContext ctx = HttpContext.Current; is not being used...

  • R VPosted Jan 24, 2019, 10:55 PM

    Didn't work.. HttpContext.Current.Session["userId"] has thrown null. I've session["userId"] when user logs into application but session is always null in action filter attribute. Can you help?

    • Lu SanchezPosted May 17, 2019, 5:55 AM

      "userId" must be your own object. Is null because there is no such object in your code.