Forms authentication and session expiration

Tech-Archive recommends: Fix windows errors by optimizing your registry

Hi

I am using role base forms authentication in asp.net and have come
across a problem that I would like advice on.

On a successful login a session variable is set to identify a user.
This is all good as this session variable is used to retrieve data for
that user etc. However if I restart the webserver then the users
session is lost but the ticket is still active. Therefore the user is
not redirected back to the login page.

My question is what is the best approach to see if the user session is
still active and sign out the user from forms authentication.

I do not really want to perform a check on every member page. Nor can I
perform a check in global.aspx as there are some non mmbers pages that
can be viewed. I also do not wish to rebuild the session if the users
session has expired.

I am sure that there is an easy answer however I can not come up with
the best approach.

Can any one help?

.

Relevant Pages

  • Re: HELP Connection error on Release mode
    ... "Off" Always display detailed ASP.NET error information. ... This section sets the authentication policies of the application. ... Set trace enabled="true" to enable application trace logging. ... <!-- SESSION STATE SETTINGS ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Session Fixation Vulnerability in Web-based Applications
    ... session, without modifying the way servers generate session ID's is as ... Think of the http server generated sessions as "UI Sessions" and as ... no impact on authentication. ... "authentication key" for this domain (usually in the form of a new ...
    (NT-Bugtraq)
  • Re: [PHP] Re: a question on session ID and security
    ... constructed to produce the actual authentication token. ... looking at the cookies on the client gets no indication that you're ... testing for remote session hijacking weaknesses. ... blinded by a bright shiny new algorithm. ...
    (php.general)
  • Re: Forms authentication vs session variable
    ... There is a known security vulnerability called "Session Hijacking", ... and there are standard ways of protection. ... With forms authentication being the standard approach, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Forms authentication vs session variable
    ... There is a known security vulnerability called "Session Hijacking", ... and there are standard ways of protection. ... With forms authentication being the standard approach, ...
    (microsoft.public.dotnet.framework.aspnet)