ASP.NET Membership - User Times out Earlier than Expected

Question

Is there any other reasoning other than the timeout setting in the web.config not being used? It might be the default timeout of 30 minutes but it is definitely less than 30 minutes.

        <authentication mode="Forms">
        <forms timeout="50000000" loginUrl="content/login.aspx"/>
    </authentication>

And for the code behind on my Login.aspx page:

    protected void LoginButton_Click(object sender, EventArgs e)
{
    if (Membership.ValidateUser(UserName.Text, Password.Text))
    {
        FormsAuthentication.RedirectFromLoginPage(UserName.Text, RememberMe.Checked);
    }
    else
    {
        FailureText.Text = "<br/>Login Failed. Please try again";
    }

}

[Edit]

I believe the timeout occurs around 10 minutes of idleness..

I am having a similar problem. My site works fine locally but on the webhost the auth ticket expires after about an hour. Did you ever figure this problem out? — codette, May 12 '09 at 16:54
Does this help? http://stackoverflow.com/questions/481416/asp-net-membership-issues-with-registration — juan, Feb 12 '09 at 22:26

score 2 · Accepted Answer · answered Feb 08 '09 at 19:47

The ASP.NET authentication timeout can be set in the web.config file (as you've shown in your question), however, this can also be set in code. Do you have any areas of your C# code that explicitly set the forms timeout value? If so, the setting in code will override the web.config setting.

Another possibility is the use of a code-generated forms authentication cookie. This is usually done, again in the C# code, with something like the following:

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
                                                            name,
                                                            isPersistent,
                                                            expirationTime);

If you create a specific FormsAuthenticationTicket with a timeout setting of (for example) 60 minutes, whilst your web.config setting indicates 30 minutes, the ticket set from within code will override the web.config setting.

Please note that the ASP.NET Session and the IIS Session time out values should have no effect on your forms authentication timeouts.

Of course, as a last possibility, since forms authentication is usually based upon a client-side cookie, it could just be possible that the user is clearing/deleting the cookie. This would of course result in the user not being authenticated with your website.

Please also take a look at this post from Scott Forsyth on the weblogs.asp.net site that details these very issues.

yeah I looked at that link you sent me before thats why I posted my code which doesn't generate it's own ticket. — TimLeung, Feb 08 '09 at 19:58
It wasn't entirely clear from the small snippet you posted that you're not setting the form ticket or the timeout value manually via code. However, if you're not doing that, I can't think of another reason, other than those I've mentioned in my post that would cause the timeout after 10 mins. — CraigTP, Feb 09 '09 at 20:15

score 1 · Answer 2 · answered Feb 08 '09 at 19:15

1

Probably related to Session timeout, you can change the timeout of the users session in the web.config, inside the system.web section add:

<sessionState timeout="x minutes" />

answered Feb 08 '09 at 19:15

meandmycode

17,067
9
48
42

score 0 · Answer 3 · answered Feb 12 '09 at 22:17

0

This post, or the related links might be of some help:

slidingExpiration=NotReally timeout=NotWhatIThinkItIs

answered Feb 12 '09 at 22:17

Bravax

10,453
7
40
68

ASP.NET Membership - User Times out Earlier than Expected

3 Answers3