interesting form authentication expiration problem

[francois]

hello,

I am using forms authentication and I would like that my authentication
cookie expires after let say 1 minutes (just for the exemple).
When I log in in my longon page, the user has to input a username, password
and the click a button to effectively login.

In the event handler for my button I have the following code:

// create authentication ticket and encrypt it
FormsAuthentica tionTicket authTicket = new FormsAuthentica tionTicket(1,
TextBoxUserName .Text, DateTime.Now, DateTime.Now.Ad dMinutes(1), false,
roles);
string encryptedTicket = FormsAuthentica tion.Encrypt(au thTicket);

// Create a cookie and add the encrypted ticket to the cookie as data.
HttpCookie authCookie = new HttpCookie(Form sAuthentication .FormsCookieNam e,
encryptedTicket );

// Add the cookie to the outgoing cookies collection.
Response.Cookie s.Add(authCooki e);
You can notice in the constructor of my authentication ticket the presence
of DateTime.Now.Ad dMinutes(1) which effectively says that if the user did
not made any other requests within 1 minute, his cookie will expires and he
will have to long in again. That works FINE.

Now I want to add role authorization in my system and I read a Microsoft
article that tells me to implement Application_Aut henticateReques t(Object
sender, EventArgs e) in global.asax

I dot it and follow the MS guidelines which mainly consist of creating a
Principal object and assign it to the Context.User property. Then in can get
that User property from anywhere in my application and verify if the user as
the role authorization he needs to view the webpage.
here is the code :

string cookieName = FormsAuthentica tion.FormsCooki eName;
HttpCookie authCookie = Context.Request .Cookies[cookieName];
if(authCookie== null)
{
return;
}

// extract and decrypt the authentication ticket from the forms
authentication cookie
FormsAuthentica tionTicket authTicket = null;
try
{
authTicket = FormsAuthentica tion.Decrypt(au thCookie.Value) ;
}
catch(Exception ex)
{
return;
}

if (authTicket==nu ll)
{
return;
}

// When the ticket was created, the UserData property was assigned a
// pipe delimited string of role names.
string[] roles = authTicket.User Data.Split(new char[]{'|'});

// Create an Identity object
FormsIdentity formsIdent = new FormsIdentity(a uthTicket);

// This principal will flow throughout the request.
GenericPrincipa l principal = new GenericPrincipa l(formsIdent, roles);
// Attach the new principal object to the current HttpContext object
Context.User = principal;
Everything is working except that now with this piece of code in my
global.asax file, the authentication cookie never expires anymore... Why ?
Is there anyone who can explain me how this can happen and how I can solve
the problem?

Best regards and thank you in advance for any help

Francois