Groups | Blog | Home
all groups > asp.net security > july 2005 >

asp.net security : Forms Authentication Expiration Problem


Prasad Dannani
7/7/2005 12:00:00 AM

Hi Techies,
I am using Forms authentication for my asp.net i had given session time out
as 500
and also Forms time out also 500 even though its getting expired soon may be
4 minutes of Idleness its getting expired
see the forms auth configuration below

<authentication mode= "Forms" >
<forms name="adAuthCookie" loginUrl="LoginPage.aspx" protection="All"
timeout="500" path="/"/>
</authentication>
Had any body faced this problem earlier??

Thanks & Regards
R. Senthli Kumaran


jwalkerjr NO[at]SPAM gmail.com
7/14/2005 12:29:29 AM
Yes, many times. The Forms authentication timeout and Session timeout
work differently. Session timeout works by counting down from the last
time the use posted back (connected to) the server. Forms
authentication works on a half time scale. Basically, if the timeout
for Forms Authentication is set for 40 minutes, it waits until 20
minutes are done and then checks to see if the user has hit back to the
server.

So what I do is this. I check in the Global.asax.vb file in the
following event which basically say, if the session times out, then
expire the forms authentication ticket, which will bring them back to
the login page:

Sub Session_Start(ByVal sender As Object, ByVal e As EventArgs)
' Fires when the session is started
System.Web.Security.FormsAuthentication.SignOut()
End Sub

[quoted text, click to view]
AddThis Social Bookmark Button