Q: Everything was working until I migrated my site to IIS 6.0 / Windows 2003. After the migration, my users frequently encountered session loss problem. They sometimes got redirected to a page saying that they entered the forum with an URL that contained invalid Session ID when they submitted a post ... These problems never happened when my forum/site was hosted on an IIS 5 server / Windows 2000 server...

A: There are two modes to set up an IIS 6 server. One is called worker process isolation mode and the other IIS 5 isolation mode.

NOTE: Our latest version, 2.4.2 SP3 has built-in support for database based session management, so IIS 6 users won't have to face this problem any more. The following note applies only to users with version 2.4.2 SP2 or below.

Our forum software uses ASP's built-in session object to manage sessions and it runs fine on either modes for IIS 6, unless you use the Web Gardens feature to manage more than 1 worker processes under worker process isolation mode. The default value is 1.

To configure a Web Garden back to its original setting:

1. In IIS Manager, expand the local computer, expand Application Pools, right-click the application pool, and then click Properties.
2. Click the Performance tab, and under Web garden, in the Maximum number of worker processes box, type 1.
3. Click OK.

A user of ours, Gun, told us why the problem still persists on his site after following the above suggestion (I edited his message a bit):

We just solved lost login problem. It was caused by the "20 cookie per domain" limit. In previous years we modified our ad program to use cookies. But in the forum there are lot of banner zones so once a user is filled with cookies (I have seen 23) previous cookies start getting deleted by the browser. So after the influx of our banner cookies, APG's session cookies get deleted and users are forced to log out.

So, if you still have these lost login problems after following my suggestion above, check out the other web based software that you use because it is very possible that under the hood the other software is using cookies excessively which will force our session cookies to be deleted.

The general rules for cookie are:

4,000 byte (4Kb) limit for each cookie
Maximum limit of 20 cookies per domain

IIS 6, isolation, worker process, session lost, ASP, cookie

Samuel Chou
Forum Administrator