473,248 Members | 1,169 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,248 software developers and data experts.

Forms Authentication Cookies Never Expire

This message was originally posted to the aspnet.security newsgroup,
but no one there has ever heard of this before. That is why I am
posting this message here, so that more people will see it...

On my asp.net application, suddenly the forms authentication cookies
for clients have quit expiring. This results in users being able to
access the site from day to day without having to log in, even if
their
browers are closed and reopened hours apart or even if their machines
are rebooted. This behavior did not occur in my application at first.
The problem only began after I modified the web.config file from not
having a timeout value at all (which should have used the default
value of
30mins?) to a custom value of timeout="10". Anyways that wouldn't work
right for some reason, so I took that out and went back to no entry
for
the timeout value. Now the cookies never expire! What in the world is
going on here?

---
UPDATE

I have also manually logged out using .SignOut() several times, but
the cookies again do not expire/time-out once the users log back in. I
have also cleared cookies...same results. I have verified that
timeout="30" is present in the authentication tag of web.config just
after the loginUrl value, but still the cookies are not expiring on
ANY client machines...this is crazy!!!

This has been going on now for a couple of weeks and is getting
extremely irritating. Does anyone have a clue about what I can do to
make it work again?
Nov 18 '05 #1
3 3797
2 differnent things

timeout refers to the 'session' timeout
a session object is created on a per user basis when the user accesses the
website
the session on start in global.asax is called before anything
the timeout is reset each time they call a page(can be set in iis console)
session object can be used to hold a bunch of stuff that you define
e.g. session["jobtitle"] = admin (inC#)
when the session eventually timesout
all the session[blah] stuff is lost
the forms admin cookie is entirely different
depending upon how you have set up the authentication in web.config
the user will/won't require a formauth cookie

you can set the expiry on the cookie when you issue the cookie
for instance

set the web config to
deny='?'

this will bounce all users to the http://website/virdir/login.aspx

page where you can ask them to log in
if they enter the correct password
you issue them with a cookie
can put a checkbox 'remember me' or something
which adds an expiration date of 30 days or something
next time they go in
they have the formauth cookie so they won't need to login

hope this helps
"Joey Powell" <jo*********@goldcoinc.com> wrote in message
news:bd**************************@posting.google.c om...
This message was originally posted to the aspnet.security newsgroup,
but no one there has ever heard of this before. That is why I am
posting this message here, so that more people will see it...

On my asp.net application, suddenly the forms authentication cookies
for clients have quit expiring. This results in users being able to
access the site from day to day without having to log in, even if
their
browers are closed and reopened hours apart or even if their machines
are rebooted. This behavior did not occur in my application at first.
The problem only began after I modified the web.config file from not
having a timeout value at all (which should have used the default
value of
30mins?) to a custom value of timeout="10". Anyways that wouldn't work
right for some reason, so I took that out and went back to no entry
for
the timeout value. Now the cookies never expire! What in the world is
going on here?

---
UPDATE

I have also manually logged out using .SignOut() several times, but
the cookies again do not expire/time-out once the users log back in. I
have also cleared cookies...same results. I have verified that
timeout="30" is present in the authentication tag of web.config just
after the loginUrl value, but still the cookies are not expiring on
ANY client machines...this is crazy!!!

This has been going on now for a couple of weeks and is getting
extremely irritating. Does anyone have a clue about what I can do to
make it work again?

Nov 18 '05 #2
2 differnent things

timeout refers to the 'session' timeout
a session object is created on a per user basis when the user accesses the
website
the session on start in global.asax is called before anything
the timeout is reset each time they call a page(can be set in iis console)
session object can be used to hold a bunch of stuff that you define
e.g. session["jobtitle"] = admin (inC#)
when the session eventually timesout
all the session[blah] stuff is lost
the forms admin cookie is entirely different
depending upon how you have set up the authentication in web.config
the user will/won't require a formauth cookie

you can set the expiry on the cookie when you issue the cookie
for instance

set the web config to
deny='?'

this will bounce all users to the http://website/virdir/login.aspx

page where you can ask them to log in
if they enter the correct password
you issue them with a cookie
can put a checkbox 'remember me' or something
which adds an expiration date of 30 days or something
next time they go in
they have the formauth cookie so they won't need to login

hope this helps
"Joey Powell" <jo*********@goldcoinc.com> wrote in message
news:bd**************************@posting.google.c om...
This message was originally posted to the aspnet.security newsgroup,
but no one there has ever heard of this before. That is why I am
posting this message here, so that more people will see it...

On my asp.net application, suddenly the forms authentication cookies
for clients have quit expiring. This results in users being able to
access the site from day to day without having to log in, even if
their
browers are closed and reopened hours apart or even if their machines
are rebooted. This behavior did not occur in my application at first.
The problem only began after I modified the web.config file from not
having a timeout value at all (which should have used the default
value of
30mins?) to a custom value of timeout="10". Anyways that wouldn't work
right for some reason, so I took that out and went back to no entry
for
the timeout value. Now the cookies never expire! What in the world is
going on here?

---
UPDATE

I have also manually logged out using .SignOut() several times, but
the cookies again do not expire/time-out once the users log back in. I
have also cleared cookies...same results. I have verified that
timeout="30" is present in the authentication tag of web.config just
after the loginUrl value, but still the cookies are not expiring on
ANY client machines...this is crazy!!!

This has been going on now for a couple of weeks and is getting
extremely irritating. Does anyone have a clue about what I can do to
make it work again?

Nov 18 '05 #3
Hi Joey,

One possibility is that your logon page is being cached somewhere. This is
described in an article.
263730 Site Server Users May Be Authenticated Under the Wrong Account
http://kb/article.asp?id=Q263730

Try adding this to your logon page.
Response.Cache.SetCacheability(HttpCacheability.No Cache)

---
The next step is to try a sample application to see if it has the same
problem. Please create a new project according to this article:
http://msdn.microsoft.com/library/en...lecookieauthen
tication.asp

Does it have the same problem?

Thank you, Mike
Microsoft, ASP.NET Support Professional

Microsoft highly recommends to all of our customers that they visit the
http://www.microsoft.com/protect site and perform the three straightforward
steps listed to improve your computer’s security.

This posting is provided "AS IS", with no warranties, and confers no rights.
--------------------
From: jo*********@goldcoinc.com (Joey Powell)
Newsgroups: microsoft.public.dotnet.framework.aspnet
Subject: Forms Authentication Cookies Never Expire
Date: 3 Dec 2003 20:27:47 -0800
Organization: http://groups.google.com
Lines: 32
Message-ID: <bd**************************@posting.google.com >
NNTP-Posting-Host: 69.29.57.101
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-Trace: posting.google.com 1070512067 21189 127.0.0.1 (4 Dec 2003 04:27:47 GMT) X-Complaints-To: gr**********@google.com
NNTP-Posting-Date: Thu, 4 Dec 2003 04:27:47 +0000 (UTC)
Path: cpmsftngxa07.phx.gbl!cpmsftngxa06.phx.gbl!cpmsftng xa09.phx.gbl!TK2MSFTNGP08.
phx.gbl!newsfeed00.sul.t-online.de!t-online.de!news-spur1.maxwell.syr.edu!ne
ws.maxwell.syr.edu!postnews1.google.com!not-for-mail Xref: cpmsftngxa07.phx.gbl microsoft.public.dotnet.framework.aspnet:194303
X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet

This message was originally posted to the aspnet.security newsgroup,
but no one there has ever heard of this before. That is why I am
posting this message here, so that more people will see it...

On my asp.net application, suddenly the forms authentication cookies
for clients have quit expiring. This results in users being able to
access the site from day to day without having to log in, even if
their
browers are closed and reopened hours apart or even if their machines
are rebooted. This behavior did not occur in my application at first.
The problem only began after I modified the web.config file from not
having a timeout value at all (which should have used the default
value of
30mins?) to a custom value of timeout="10". Anyways that wouldn't work
right for some reason, so I took that out and went back to no entry
for
the timeout value. Now the cookies never expire! What in the world is
going on here?

---
UPDATE

I have also manually logged out using .SignOut() several times, but
the cookies again do not expire/time-out once the users log back in. I
have also cleared cookies...same results. I have verified that
timeout="30" is present in the authentication tag of web.config just
after the loginUrl value, but still the cookies are not expiring on
ANY client machines...this is crazy!!!

This has been going on now for a couple of weeks and is getting
extremely irritating. Does anyone have a clue about what I can do to
make it work again?


Nov 18 '05 #4

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

1
by: Joey Powell | last post by:
On my asp.net application, suddenly the forms authentication cookies for all clients have quit expiring. This results in users being able to access the site from day to day without having to log...
0
by: Joey Powell | last post by:
This message was originally posted to the aspnet.security newsgroup, but no one there has ever heard of this before. That is why I am posting this message here, so that more people will see it... ...
3
by: john | last post by:
I have 2 questions: 1. I am trying to use forms authentication. When the user logs out, I make these function calls: Session.Abandon(); FormsAuthentication.SignOut(); But after they log out,...
3
by: Martin | last post by:
Dear fellow ASP.NET programmer, I stared using forms authentication and temporarily used a <credentials> tag in web.config. After I got it working I realized this wasn't really practical. I...
3
by: Mike | last post by:
I have a web application that the forms authentication cookie is not expiring correctly. When I look at the trace information of a newly requested page after the session and forms authentication have...
4
by: Amil | last post by:
I'm using Forms authorization. In my <forms> section I have timeout="30", but when I examine the cookie, it shows it expiring in 2055? Why? <authentication mode="Forms"> <forms...
2
by: pv_kannan | last post by:
I recently found out that my authentication cookies are not expiring even though I have set the persist property to false. As a result, users are able to access the secure websites with indifferent...
3
by: Simon Harvey | last post by:
Hi All, I'm hoping somebody could help me with the following problem. I'm using forms authentication and the user is getting authenticated no problem. Once authenticated the user can look at...
10
by: Peter Bradley | last post by:
We are in the process of designing our first ASP.NET 2.0 application and have discovered that Forms Authentication works completely differently in ASP.NET 2.0. For a number of reasons, we cannot...
2
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 7 Feb 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:30 (7.30PM). In this month's session, the creator of the excellent VBE...
0
by: stefan129 | last post by:
Hey forum members, I'm exploring options for SSL certificates for multiple domains. Has anyone had experience with multi-domain SSL certificates? Any recommendations on reliable providers or specific...
0
by: MeoLessi9 | last post by:
I have VirtualBox installed on Windows 11 and now I would like to install Kali on a virtual machine. However, on the official website, I see two options: "Installer images" and "Virtual machines"....
0
by: DolphinDB | last post by:
The formulas of 101 quantitative trading alphas used by WorldQuant were presented in the paper 101 Formulaic Alphas. However, some formulas are complex, leading to challenges in calculation. Take...
0
by: DolphinDB | last post by:
Tired of spending countless mintues downsampling your data? Look no further! In this article, you’ll learn how to efficiently downsample 6.48 billion high-frequency records to 61 million...
0
by: Aftab Ahmad | last post by:
Hello Experts! I have written a code in MS Access for a cmd called "WhatsApp Message" to open WhatsApp using that very code but the problem is that it gives a popup message everytime I clicked on...
0
by: Aftab Ahmad | last post by:
So, I have written a code for a cmd called "Send WhatsApp Message" to open and send WhatsApp messaage. The code is given below. Dim IE As Object Set IE =...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.