Sessions and Forms Authentication Cookie

From: Bijoy Naick (b_naick_at_yahoo.ca)
Date: 11/16/04 

Date: Tue, 16 Nov 2004 13:14:38 -0500

I have a folder on my site secured with Forms Authentication. After the user
is authenticated, I set a session level variable.

The session time on the server is set to 20 mins. I am guessing the default
expiry time for the Forms Authentication cookie is 30 mins? Is this correct?

So after 20 mins, the session expires (assuming no user activity), but
because the forms auth cookie is still alive, users are not redirected to
the login page. The other pages are not able to read the session level
variable cuz the session has already expired.

How do I go about changing the forms cookie expiry time? I've seen a timeout
attribute to the forms tag that is used in Web.Config.. Is this what I
should be using?

Relevant Pages

  • Re: authentication cookie vs session cookie
    ... level of using authentication cookies on the client machines. ... authentication cookie on a manager's machine is stolen and used on a client ... > session variables as it relies on the session cookie that ASP.NET sends to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: authentication cookie vs session cookie
    ... doing 'cookie' authentication (effectively what you are doing when you use ... session variables as it relies on the session cookie that ASP.NET sends to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Framework bug with Auth and Session state?
    ... So as long the browser stays open, ... cookie remains, ... the authentication never times out. ... Session info is stored on the server, using the session cookie only as an ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authentication question
    ... I also found the settings and chose to set a sliding timeout for the ... complained about having to login when I knew their session had not expired. ... > The session timeout and forms authentication cookie timeout are ... > authentication cookie but all of the inproc session state is gone. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: asp.net web farm configuration - (cookie domains?)
    ... authentication cookies, giving them the required cookie domain. ... >> I expect to use a SQL database for session state management, ... >> My application uses web forms authentication, with a secure cookie, ie. ...
    (microsoft.public.dotnet.framework.aspnet)