I have a classic ASP web application with a log-in page containing a form for username and password. The ASP page that the form is posted to has the following line at the top:

Session.Timeout = 300

The same page then checks the username and password against the database and, if the details are valid, sets a session variable as follows:

Session("isLogged") = True

So now the user is logged in for a session lasting 5 hours (300 mins). This works fine.

Now, the logged-in user clicks a link which opens a new window. The page that is displayed checks the status of the "isLogged" session variable. If it is True then the page is displayed, otherwise the page redirects to a page that displays the message "your session has timed out".

All this works fine (IE 6+ and Firefox 1+).

HOWEVER - some users report that the session times out early in the new window (within 30 mins). I cannot see a reason for this.

Please can you tell me if I am missing something here, regarding the correct use of session variables.

Thanks.