Re: session won't timeout

many apologies Mike for the double post

iisreset - a hundred times

anyone else?

more info

Maybe this is a session cookie issue? When I check the cookies at the
client browser there is this one: WSS_KeepSessionAuthenticated Expires: At
the end of session. If I kill the session cookie using IE Developer Toolbar,
the IIS challenge pops up. If I close the browser also the cookie will be
destroyed.

When I look in the IE cache during a Sharepoint Session there is one cookie
from my web server set to expire in thirty minutes. If I delete it during
the session without closing IE I can continue to stay authenticated and work
as usual. Again, if I used a tool like Developer Toolbar to kill the session
cookie I will be prompted to re-authenticate.

So I guess my question is if anyone knows how to control this cookie
behavior in sharepoint? Can you make it expire in someone's browser? Maybe a
web.confg setting?

Also does anyone know the equivalent command in stsadm for this:
WSS Application General Settings: Security Validation On, Expires after 1

I've had issues before using the UI to make system changes.

Thanks again




"Mike Walsh" wrote:

Please decide whether you post a message to a forum or to a newsgroup.

There's no point in posting identical messages to both Microsoft public
forums and Microsoft public newsgroups on the same day (as you did with this
one).

No answer on the question as you seem to have covered the bases.

I'm surprised this

WSS Application General Settings: Security Validation On, Expires after 1
minute

isn't having the desired effect.

You've run iisreset for luck I suppose.

Mike Walsh
WSS FAQ: www.wssv3faq.com / wss.collutions.com
No private questions please (additions to FAQ welcome)

"IanM" <IanM@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:565AF876-7F3F-4529-B6F1-5BCD69201E0C@xxxxxxxxxxxxxxxx
Hi all,

I'm trying to get my site to re-authenticate the user after a period of
inactivity (to speed testing I'm trying one minute). I'm assuming this is
possible and IIS would throw another challenge . The problem now is that
a
user can leave their computer indefinitely, return, and keep on working.
The
relevant information is as follows:

Authentication mode: Basic Authentication over SSL(selfSSL cert)
authenticating to an AD server.

IIS Connection Timeout: 60 seconds
IIS Content Expiration enabled, expires immediately
ASP State Mgmt: InProc, UseCookies, Session Timeout 1 min.
WSS Application General Settings: Security Validation On, Expires after 1
minute

My environment is:
Windows 2003 R2 Web Edition
WSS 3.0
IIS 6.0
I've been testing on both Firefox and IE browsers, internally and
externally

Any help would be appreciated. Thanks much
Ian




.

Relevant Pages

  • Re: IIS 6 Session_Start Inconsistency???
    ... want to upgrade all my clients to IIS 6.0, but this issue is a deal killer ... >>> settings into Session from the database. ... >>> a valid cookie, an exception may trigger the recycling ... > of a worker ...
    (microsoft.public.inetserver.iis)
  • Re: Sessions vs Cookies
    ... There is a session cookie which simply allows the server to identify the client and retrieve relevant session data for it. ... If cookies can be read or forged, it makes little odds whether you have the master key or all the little keys,. ... Suppose you only send the PHPSESSID: Now you cannot change a thing on the server, even if you have the 'master key'. ...
    (comp.lang.php)
  • Re: Is it safe to store user_id in Session?
    ... What I was wondering is how safe it is to store user_id or username or ... session so I do not need to search the database all the time. ... OVERRIDING BASIC SESSION COOKIE AUTHENTICATION ... So what is described in the article only works for bad php scripts. ...
    (comp.lang.php)
  • Chicken and egg issue with Cookie based login?
    ... I have few questions I hope someone can clear up for me with the cookie ... private web server. ... It also says this about the secret key: ... Second, would be an example of the "Session ID" or more general, what is an ...
    (comp.security.misc)
  • Re: web replication
    ... Session cookies relate to memory in the server, ... cookie, then yes it's a problem if one cannot be certain of which box ... , i'm actually studying the lvs documentation, ipvs via nat use nat to ...
    (comp.os.linux.networking)