Should I use Session State or FormAuthentication to keep track of a signed-in user?

Question

I'm sure this question has been asked before, but I cannot find it with neither Google nor the suggested threads given to me while typing this question up. So without further Ado:

I am creating an application in which I would like to keep a user logged into my system. From what I understand, session state variables are pretty secure. So would it be safe to keep a user logged into the system (I'm thinking 1 day maximum), by checking their password against the database, if it matches, create a session variable like so:

Session["Expires"] = DateTime.Now.AddDays(1);

and using that that session variable to keep the user signed in by checking if DateTime.Now is less than Session["Expires"]? So if no session variable exists (never logged in), or the user has changed the session ID in their cookies it would just see them as not logged in and they would not have access anymore.

check cache http://msdn.microsoft.com/en-us/library/18c1wd61(v=vs.90).aspx — Mate, Apr 05 '14 at 03:33
Thank you for the link Mate. They seem to be quite similar. What benefits does Caching have over Sessions? — Vandel212, Apr 05 '14 at 03:55
Yes Form Authentication was perfect. I actually used the link from the user that answered this question. The tutorial was very clear and easy to implement. Thank you for the help. — Vandel212, Apr 08 '14 at 23:34

Win · Accepted Answer · 2017-08-21T18:31:13.257

By default, Session timeout is 20 minutes. It is enough for most applications due to sliding expiration.

Ideally, you do not want to set Session state timeout higher, because opening session takes up server memory.

Back to the original question

ASP.Net already has that feature called FormAuthentication, so you do not need to start from scratch. It uses Cookie instead of Session state. I'm sure you have seen Remember Me checkbox at Login screen.

It basically save FormAuthenticationTicket in the cookie with the timeout that you set in web.config.

For example,

FormsAuthentication.SetAuthCookie("username", false);

Since this question is not about FormAuthentication, I do not want to go detail into it. I hope you get the idea.

Here is the another example at SO. You can also download my sample application at GitHub - Login.aspx.cs and Global.asax.cs.

Thank you very much for pointing out the tutorial on how to do Forms Authentication. I implemented it and it works very well, and super easy to boot. Thanks Again. — Vandel212, Apr 07 '14 at 22:41

Should I use Session State or FormAuthentication to keep track of a signed-in user?

1 Answers1

Back to the original question

Linked