Re: How long is the formsauthentication ticket valid

From: avnrao (avn_at_newsgroups.com)
Date: 04/29/04


Date: Thu, 29 Apr 2004 18:23:29 +0530

the timeout you specify in the web.config will be considered.

<authentication mode="Forms">
   <forms name=".ASPXFORMSDEMO" loginUrl="logon.aspx"
   protection="All" path="/" timeout="30" />
</authentication>

the AuthCookie is stored as cookie (not a session variable) on the client.
each time you get a request to the server, you need to read this cookie and
populate your Context.User with a GenericPrinciple object created using this
cookie. This generally is done in Application_Authenticate method in
global.asax file.

more info :
http://support.microsoft.com/default.aspx?scid=kb;en-us;301240&Product=aspnet

hth,
Av.

"Swati" <swatisahasrabudhe@yahoo.com> wrote in message
news:abadda58.0404290359.399d040e@posting.google.com...
> Hello
>
> These questions may seem stupid but I am confused about the
> formsauthentication ticket stuff. From what I know till now it is a
> cookie/session variable ( I am still not sure which of the two).
> 1. When I use a FormsAuthentication.SetAuthCookie method I do not
> specify a timeout. So how long is this valid.
> 2. Is this the same thing that I later access using
> Contect.User.Identity?
>
> Any help appreciated.
>
> thnx,
> Swati



Relevant Pages

  • Re: Cookie Security
    ... > I simply have to sniff the session id cookie, and specify this from another client, and I am signed into the application as the associated user. ... encode the clients IP address in the token. ...
    (Security-Basics)
  • Re: how to prevent auth ticket expiration
    ... just an event not an override so unfortunately the expiration timeout is still refreshed since the MS Authenticate code is still executing. ... If you specify the identity, it won't be read from the forms auth cookie, and you won't get the extention of the cookie timeout. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: [PHP] Setting cookies for other domains
    ... > I've always known that you can specify a domain when you set a cookie, ... Seems to me that browsers wouldn't allow this as it could ... It allows you to specify the domain for which the cookie is valid. ... Chris Shiflett ...
    (php.general)
  • Re: cookie domain question
    ... mike wrote: ... That's probably because you didn't specify the path parameter, resulting in the path being set to the URL path of the directory where the script is located. ... As regards more recent Perl tools for cookie handling, you may want to check out the modules CGI.pm and HTTP::Cookies. ...
    (comp.lang.perl.misc)
  • Re: Cookie setting with IP address, not Domain name
    ... the domain you specify for the cookie must belong to request domain. ... browser is seeing an ipaddress, then you can not specify a domain. ... This results in Firefox denying the cookie, ...
    (microsoft.public.dotnet.framework.aspnet)