Re: Sessions and Forms Authentication Cookie

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: George Durzi (gdurzi_at_hotmail.com)
Date: 11/16/04 

Date: Tue, 16 Nov 2004 11:49:48 -0700

You can also set the expiration time of the forms authentication cookie in
your web.config file.
I set it so it's the same as my session timeout.

"Bijoy Naick" <b_naick@yahoo.ca> wrote in message
news:OaV2jgAzEHA.1040@TK2MSFTNGP10.phx.gbl...
>I have a folder on my site secured with Forms Authentication. After the
>user
> is authenticated, I set a session level variable.
>
> The session time on the server is set to 20 mins. I am guessing the
> default
> expiry time for the Forms Authentication cookie is 30 mins? Is this
> correct?
>
> So after 20 mins, the session expires (assuming no user activity), but
> because the forms auth cookie is still alive, users are not redirected to
> the login page. The other pages are not able to read the session level
> variable cuz the session has already expired.
>
> How do I go about changing the forms cookie expiry time? I've seen a
> timeout
> attribute to the forms tag that is used in Web.Config.. Is this what I
> should be using?
>
>

Relevant Pages

  • Re: proper way to logout and end a session
    ... also the authentication cookie is separate from the session cookie. ... as the second site is opened from the first, its cookies are not deleted by the browser when the window is closed, so when the site is reopened, the authentication cookie is still active. ... And when people click the logout link inside the application, the application will close this second browser window. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Problem with Forms Authentication
    ... not persist the authentication cookie beyond the session ... so each time a user starts a session they must go through ... user to 'Remember Me' using a checkbox and persisting the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Questions About Session Timeout
    ... The IIS config will handle the session state, and the forms auth will handle the authentication cookie. ... This is what the auth cookie lifetime is for, which you set in the forms auth section of the web.config. ...
    (microsoft.public.dotnet.framework.aspnet)
  • forms authentication cookie changes
    ... the forms authentication cookie and use it later when submitting another ... request to the server. ... change the forms authentication cookie (in contrast to the session cookie ... which stays the same the whole time the session is in existence). ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: what in place of session variables
    ... Once Membership is installed the use of the Profile can be used to store session data rather easily. ... It has most of the logic all set for you and will set the encrypted forms authentication cookie for you as well. ... Main problem is that I save user authentication info into session variables, and once these variables fall to Null, user is sent again to the login page. ...
    (microsoft.public.dotnet.framework.aspnet)