[BattlFrog]

I am trying to understand how session tieouts work. i am writing an MVC app (wait, dont run!). I am not posting the MVC area because you can wait a long time to get an answer in there, and timeouts don't working MVC anyway.

I am just trying to find out how they work. I have found some info from searching but the main question I have is, does the user have to be logged in, for a session timeout to work? For example, if the page is a public facing form that anyone can get to on the internet, can session detect when they start filling out the form, and timeout after a certain amount of time?

Thank you.

[Skydiver]

In a raw HTML only webpage without any AJAX, timing out can be very difficult. This is part of the reason it doesn't work if you go pure MVC. Only during the POST and response segment of the cycle can the server let the client know that it's timed out because it's been too long between POST's.

For Web 2.0 and later pages that use AJAX, the client page can send updates back to the server to notify it that activity is happening and so therefore reset the timeout timer. The client page is also actively querying the server if the session has timed out. I would imagine that there is some kind of session id or key is used to distinguish one client versus a different client, specially if the website has multiple front ends and a load balancer.