I have tried the below configs. But still, it is not working.

<setting name="Authentication.ClientSessionTimeout" value="180" />
<authentication mode="None">
  <forms name=".ASPXAUTH" cookieless="UseCookies" timeout="180" />
<sessionState mode="InProc" cookieless="false" cookieName="ASP.NET_SessionId" regenerateExpiredSessionId="true" cookieSameSite="None" timeout="1" sessionIDManagerType="Sitecore.SessionManagement.ConditionalSessionIdManager, Sitecore.Kernel">

Is there any other config file in Sitecore where I need to set the timeout value for Asp.net SessionId?

  • Do you have analytics enabled? Also, check if you have VisitorIdentification included. Sep 15, 2022 at 8:05
  • Try this. In the Sitecore.Owin.Authentication.config there is setting for ExpireTimeSpan for CookieAuthentication and PreviewCookieAuthentication. Update them and check if it works. Sep 15, 2022 at 8:17
  • @PrashantTomar yes analytics is enabled and included visitorindentification also.
    – indu mathi
    Sep 15, 2022 at 9:03
  • @SumitBhatia I have updated the ExpireTimeSpan in Sitecore.Owin.Authentication.config. Still the session is not getting expired.
    – indu mathi
    Sep 15, 2022 at 9:04

3 Answers 3


In order to modify a user session default timeout, you would need to adjust the following settings:

In CM server -

  1. in the file \App_Config\Sitecore\Owin.Authentication\Sitecore.Owin.Authentication.config update setting ExpireTimeSpan for processor name="CookieAuthentication".

In Identity Server -

  1. in the file \sitecore\Sitecore.Plugin.IdentityServer\Config\identityServer.xml update the settings CookieLifetime and for defaultClient update setting IdentityTokenLifetimeInSeconds
  2. Restart the Identity server app service.

Setting timeout="1" is enough to make sure that contact session lasts 1 minute.

You don't need anything else unless you have login mechanism and you want to make sure that contacts are logged out.

I can see that you configured regenerateExpiredSessionId="true" which can mislead to wrong impression that it's the same session while indeed it's a new session with the same session id. Try changing that attribute to false.

  • in my case the anonymous user browses around my site and i want to retrieve the user values when the session ends.
    – indu mathi
    Sep 15, 2022 at 10:12
  • And how you try to retrieve the data? Is there any user data in your xDB?
    – Marek Musielak
    Sep 15, 2022 at 10:35
  • I'm inheriting this pipeline ConvertToXConnectInteractionProcessorBase. so once the session ends the pipeline has to get triggered. Then i'll get some values from args like pageevents and some more. But the session is not getting expired. Can you tell me exactly in which table in need to check for user data.
    – indu mathi
    Sep 15, 2022 at 15:29
  1. Verify that you have restart the application after saving the web.config correctly.

  2. Also please make sure there are no patch files overring setting .

  3. Check for any analytics or custom logging code that may conflicts with the session lifetime.

  4. Try setting regenerateExpiredSessionId="false" to maintain the same ASP.NET session ID when the session is renewed.

  5. Ensure the browser cookies are not cleared or blocked when testing session by any security concerns or settings.You can test this by verifying that the ASP.NET_SessionId cookie is being set correctly.

I hope this helps you troubleshoot the issue and please provide further info if new findings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.