Session.Timeout in Classic ASP: Set and Check Session Expiry

Session.Timeout sets the number of idle minutes a Classic ASP session can keep its server-side data. If the visitor does not make another request associated with that session before the limit is reached, IIS ends it. It is an inactivity limit, not a countdown from the moment a user signs in.

Quick example: set and display a 10-minute timeout

<%
Session.Timeout = 10
Response.Write "Session timeout: " & Session.Timeout & " minutes"
%>

Output: Session timeout: 10 minutes. This sets the value for the current session. The next request associated with the active session refreshes the inactivity period.

Session.Timeout syntax

Session.Timeout = minutes
Response.Write Session.Timeout

minutes is the idle-time limit assigned to the current session, expressed as a number of minutes. Unlike Server.ScriptTimeout, which controls a request-processing limit, this property concerns the lifetime of idle session state.

Set the inactivity timeout for the current session

<%
Session.Timeout = 10
%>

Add this statement to the ASP page where you need to configure the session. The value is specific to the session being processed; it does not change the server-wide setting for other users.

Use shorter values for sensitive pages

<%
Session.Timeout = 5
Response.Write "Idle timeout is " & Session.Timeout & " minutes."
%>

Output: Idle timeout is 5 minutes. A short timeout reduces the time session data persists when visitors leave, but users may need to sign in again more often.

Display the current Session.Timeout value

Use the value directly in Response.Write. The following version retains the original tutorial’s two-line message:

<%
Response.Write "Your session will time out after " & _
    Session.Timeout & " minutes"
%>

Output: Your session will time out after 20 minutes when the current value is 20. If it was set to 10, the output displays 10 instead. The underscore is VBScript’s line-continuation character and must be preceded by a space.

Display the current session ID for debugging

<%
Response.Write "Timeout: " & Session.Timeout & " minutes<br>"
Response.Write "Session is active"
%>

Avoid exposing Session.SessionID in a public page: session identifiers are sensitive. A simple test message and session-stored value are usually sufficient for learning and debugging.

When does a Classic ASP session expire?

The inactivity timer is measured from the most recent request associated with the session, not from the first page load. A page that is left open without requests does not, by itself, keep the session alive.

Practical example: save and check a session value

Try these two files in the same Classic ASP application on IIS. The first page creates a session value; the second checks whether it is still present.

File 1: start-session.asp

 Copy<%@ Language="VBScript" %>
<%
Option Explicit
Session.Timeout = 10
Session("tutorialVisitor") = "Alex"
Response.Write "Saved visitor: " & Server.HTMLEncode(Session("tutorialVisitor"))
%>
<p><a href="check-session.asp">Check the session</a></p>

Output: Saved visitor: Alex. Open check-session.asp before the timeout to see the stored value.

File 2: check-session.asp

 Copy<%@ Language="VBScript" %>
<%
Option Explicit
If IsEmpty(Session("tutorialVisitor")) Then
    Response.Write "Session value is missing or has expired."
Else
    Response.Write "Welcome back, " & _
        Server.HTMLEncode(Session("tutorialVisitor"))
End If
%>

On the first visit, the output is Welcome back, Alex. After the session expires, the stored value is no longer available and the page displays the fallback message. A missing value can also occur if the visitor never opened the first page, explicitly logged out, or session state was lost due to a server restart.

Handling an expired session value safely

 Copy<%
If IsEmpty(Session("tutorialVisitor")) Then
    Response.Write "Please start the session again."
Else
    Response.Write Server.HTMLEncode(Session("tutorialVisitor"))
End If
%>

Check for an expected session value rather than treating the number returned by Session.Timeout as proof that a visitor is signed in. Learn more about storing values in Session variables.

Check authentication on each protected page

In a real member area, a login handler should set a session flag only after validating credentials on the server. Each protected page must check that authentication state still exists.

 Copy<%@ Language="VBScript" %>
<%
Option Explicit
If IsEmpty(Session("isAuthenticated")) Then
    Response.Redirect "login.asp"
ElseIf Session("isAuthenticated") <> True Then
    Response.Redirect "login.asp"
End If
%>
<h1>Member area</h1>
<p>This page is for signed-in users.</p>

Here login.asp is a placeholder for your actual login route, not an extra file supplied with this tutorial. Do not set the flag to True merely because a visitor opened the page. For a complete access-control flow, see checking login sessions and protecting member pages.

End a session deliberately with Session.Abandon

Session.Abandon is used when the visitor signs out. IIS disposes of the session state after the current ASP page has finished processing; it is not removed at the exact moment the statement executes.

 Copy<%@ Language="VBScript" %>
<%
Option Explicit
Session.Abandon
Response.Write "You have signed out."
%>

Output: You have signed out. The next request should not be trusted as authenticated until it passes the login process again.

Simple sign-out redirect

<%
Session.Abandon
Response.Redirect "login.asp"
%>

Replace login.asp with your actual sign-in URL. If your site also uses authentication cookies or persistent login tokens, handle those in the logout flow too; abandoning the Classic ASP session alone does not revoke every possible credential.

Change the application default in IIS

The configured Classic ASP session timeout is commonly 20 minutes by default. An IIS administrator can change it for the site or application: open IIS Manager, select the application, open ASP, expand Session Properties, edit the timeout setting and apply the changes.

In IIS configuration, the corresponding property is system.webServer/asp/session with a timeout value formatted as hh:mm:ss. That setting differs from the minute value used in ASP code:

<system.webServer>
  <asp>
    <session timeout="00:10:00" />
  </asp>
</system.webServer>

The snippet shows the relevant configuration section. Whether you can set it in an application-level web.config depends on IIS configuration permissions and section locking. An administrator should apply the change at an authorized configuration level.

Microsoft documents the IIS ASP session settings and default timeout. The ASP-specific session start and end behavior is also described in Microsoft’s classic documentation.

Session timeout versus other time limits

Troubleshooting Session.Timeout

Frequently asked questions

Related Classic ASP tutorials

Back to top ↑

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: