RE: Detecting session time out in custom log in page

From: MSFT (lukezhan_at_online.microsoft.com)
Date: 10/08/03 

Date: Wed, 08 Oct 2003 08:04:34 GMT

Hi Steve,

The TimeOut attribute here only make sense when we use non-persistent
cookie for the form authentication. When it is timeout, the cookie has a
null value which is same as a new login. We can't decide from it.

Anyway, we may set a session variant when your user first logon, for
example, record the logon in time. This can be an evidence when we check if
it is a new login or get back from timeout.

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

Relevant Pages

  • Forms authentication doesnt timeout
    ... I have set up my configuration file like this: ... If the cookie does not exist on my machine, ... redirected to the login page, and after I signin, I am redirected back ... the timeout never seems to happen. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authentication question
    ... I also found the settings and chose to set a sliding timeout for the ... complained about having to login when I knew their session had not expired. ... > The session timeout and forms authentication cookie timeout are ... > authentication cookie but all of the inproc session state is gone. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Persistent Cookies
    ... Yes I know that they arent used for session management. ... happen was the framework itself had set the timeout for a persistent cookie ... set the timeout for persistent cookies in our configuration. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: forms authentication question
    ... sliding timeout or absolute timeout, but my problem is that the ... sliding expiration does not get updated all the time. ... So, if I set the sliding expiration to 20 minutes, the cookie will be updated after 10 minutes, and if the user did something in the first 10 minutes, but then didn't do anything for the next 15 minutes, forms authentication cookie will be timed-out. ... Storing custom session key in the cookie gives me an ability to renew the cookie as long as the session key has not expired. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: forms authentication question
    ... I can increase the timeout on the forms authentication cookie, but I really would like to keep both the session key and the forms authentication cookie close to each other if possible. ...
    (microsoft.public.dotnet.framework.aspnet.security)
Quantcast