While developing web sites it can be annoying that I have to login to the site. Every time the session runs out I have to go through a flow like...
Open logon page -> enter username/password -> click link to navigate to my page.

I sometimes use Selenium to record this flow, and then automate it. But Selenium doesn't work in all browsers, and it still takes too long to load etc.
I would like to be able to just refresh the page, exactly like I would if the site didn't have a login page.

Does anyone use any strategies to achieve this? Any way to disable login during development? Or other tools which can help improve the situation?

4 Answers 4


Why sessions are expiring? Is it because:

  • They were inactive for a certain delay?

    In this case, just increase the delay.

  • Or because recompiling the web application threw out application cache and current sessions?

    In this case, store sessions on a less volatile support, like the database. This would also give you the advantage to be able to run the web application on multiple servers for redundancy or higher scalability.

In both cases, unless you're working on a web application of a bank, give to your users the ability to remember credentials on logon through cookies and use it yourself.

While technically, it's not the same as staying logged in (since the web app will be forced to authenticate the user according to the values in cookies), from the users' perspective, there is no big difference, since they don't have to see the login form again for weeks or months.


Rather than disable the login, manually invoke your login procedure on Session start.

For example, in pseudo code, do the following:

protected void Session_Start() {
    /* Login */
    LoginController.LogUserIn("myUsername", "myPassword");

This, of course, holds true only for development systems with development passwords. If you need this for a production system I'd be looking for SSO options.

  • -1. Why, for God's sake, would you hardcode a password and mess up with security (with the risk of forgetting this while deploying the application to production environment), while circumventing the problem instead of solving it? Mar 6, 2013 at 13:28
  • Did you read the question? The poster asked for during development. I specifically said for dev only in my answer and I answered the question.
    – Sam
    Mar 6, 2013 at 13:33
  • I've read the question, and still, I find your answer completely, totally wrong, security-wise. For plenty of reasons. (1), people are people, and if they mess up with deployment process, your code will end up in production. (2), hardcoding any password when you can avoid it is wrong. (3), multiple developers will share the same account, which will inevitably cause problems sooner or later and is not flexible. (4), testing such code is a nightmare. (5), what about staging environment? etc. Mar 6, 2013 at 13:37
  • So surround it with a #if DEV_DEBUG block. Mar 6, 2013 at 16:18

A session has a time limit associated with it. This is set when the session is created. You can set the time limit to a long time for debugging purposes.


A sessionlogouttimer resets when a new page is loaded, set your browser to autoreload the page and your session should not run out.

You can use a meta tag in your page :

(meta http-equiv="refresh" content="3")

or use a plugin for your browser.

Don't forget to remove the meta tag when you set it live though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.