I'm using Forms authentication and a non persistent cookie in my
asp.net application.
How do i get the cookie to time out after a period of inactivity, say
10 minutes, and force the user to login again?
If I close the browser, the next time I use the application, it makes
me log in - and That's fine.
However if I keep the browser session open, it keeps my login valid for
as long as the browser is open - I want it to time out.
Specifying the timeout value in the web.config seems to have no effect.
any pointers? Code appended. Thanks!
<authentication mode="Forms">
<forms loginUrl="logon.aspx" name = "portal" timeout="10"
slidingExpiration="true" protection="All" path="/">
</forms>
</authentication>
// Create the authetication ticket
FormsAuthenticationTicket authTicket = new
FormsAuthenticationTicket(1, txtUserName.Text, DateTime.Now,
DateTime.Now.AddMinutes(10),false, "");
// Now encrypt the ticket.
string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
// Create a cookie and add the encrypted ticket
HttpCookie authCookie = new
HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
// Add the cookie to the outgoing cookies collection.
Response.Cookies.Add(authCookie);
Session.Add("Login", txtUserName.Text);
Session.Add("Group",Group);
Page.SmartNavigation = false;
//Redirect the user to the originally requested page
Response.Redirect(FormsAuthentication.GetRedirectU rl(txtUserName.Text,false)); 8 3171
Belle,
Just after you create your cooke and before you add it to the response use
authCookie.Expires = DateTime.Now.AddMinutes(10);
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
<ba***********@gmail.com> wrote in message
news:11**********************@g47g2000cwa.googlegr oups.com... I'm using Forms authentication and a non persistent cookie in my asp.net application. How do i get the cookie to time out after a period of inactivity, say 10 minutes, and force the user to login again? If I close the browser, the next time I use the application, it makes me log in - and That's fine. However if I keep the browser session open, it keeps my login valid for as long as the browser is open - I want it to time out. Specifying the timeout value in the web.config seems to have no effect. any pointers? Code appended. Thanks!
<authentication mode="Forms"> <forms loginUrl="logon.aspx" name = "portal" timeout="10" slidingExpiration="true" protection="All" path="/"> </forms> </authentication>
// Create the authetication ticket FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(1, txtUserName.Text, DateTime.Now, DateTime.Now.AddMinutes(10),false, "");
// Now encrypt the ticket. string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
// Create a cookie and add the encrypted ticket HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
// Add the cookie to the outgoing cookies collection. Response.Cookies.Add(authCookie); Session.Add("Login", txtUserName.Text); Session.Add("Group",Group);
Page.SmartNavigation = false; //Redirect the user to the originally requested page Response.Redirect(FormsAuthentication.GetRedirectU rl(txtUserName.Text,false));
Justin,
Thank you... it works!!
-Belle
Belle,
You're welcome!
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
<ba***********@gmail.com> wrote in message
news:11**********************@g43g2000cwa.googlegr oups.com... Justin,
Thank you... it works!!
-Belle
But now I have a new problem.....
If I happen to close the browser session before the 10 minute timeout,
and open a new session, it doesnt force me to log in.
I am essentially wanting to use a non persistent cookie that will
expire with the browser session, but will also timeout after a period
of inactivity.
pointers?
thanks.
Belle,
Use the forms authentication object's redirect:
FormsAuthentication.RedirectFromLoginPage(username .Text, false)
Setting the second parameter to false sets a non-persistent cookie.
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
<ba***********@gmail.com> wrote in message
news:11**********************@o13g2000cwo.googlegr oups.com... But now I have a new problem.....
If I happen to close the browser session before the 10 minute timeout, and open a new session, it doesnt force me to log in.
I am essentially wanting to use a non persistent cookie that will expire with the browser session, but will also timeout after a period of inactivity.
pointers?
thanks.
Justin,
still no luck....back to square one, the cookie behaves like a non
persistent cookie, and expires only if the browser is closed.
Despite the timeout specified as 10 minutes, the cookie never times
out.... what am I doing wrong?
my web.config:
<authentication mode="Forms">
<forms loginUrl="logon.aspx" name = "portal" timeout="10"
slidingExpiration="true" protection="All" path="/">
</forms>
</authentication>
when the user attempts to logon:
// Create the authetication ticket
FormsAuthenticationTicket authTicket = new
FormsAuthenticationTicket(1, txtUserName.Text, DateTime.Now,
DateTime.Now.AddMinutes(10),false, "");
// Now encrypt the ticket.
string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
// Create a cookie and add the encrypted ticket to the
// cookie as data.
HttpCookie authCookie = new
HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
// Add the cookie to the outgoing cookies collection.
authCookie.Expires = DateTime.Now.AddMinutes(10);
Response.Cookies.Add(authCookie);
Session.Add("Login", txtUserName.Text);
Session.Add("Group",Group)
Page.SmartNavigation = false;
// Redirect the user to the originally requested page
FormsAuthentication.RedirectFromLoginPage(txtUserN ame.Text, false);
Do I need to edit the machine.config?
Thanks,
Belle
Belle,
At this point there are more possibilities than I can go into here. Try
looking through this article: http://msdn.microsoft.com/library/de...aght000012.asp
It should contain all the information you need. If you don't solve your
problem here let me know. By the way, what are you using the Session object
for? are you using cookies or the session variable for your timeout? If
you're actually using the session then it won't time out until ten minutes
have gone by from the last time the client has contacted the server. And
closing the browser won't mater...
--
Sincerely,
S. Justin Gengo, MCP
Web Developer / Programmer www.aboutfortunate.com
"Out of chaos comes order."
Nietzsche
<ba***********@gmail.com> wrote in message
news:11**********************@z14g2000cwz.googlegr oups.com... Justin,
still no luck....back to square one, the cookie behaves like a non persistent cookie, and expires only if the browser is closed. Despite the timeout specified as 10 minutes, the cookie never times out.... what am I doing wrong?
my web.config: <authentication mode="Forms"> <forms loginUrl="logon.aspx" name = "portal" timeout="10" slidingExpiration="true" protection="All" path="/"> </forms> </authentication>
when the user attempts to logon: // Create the authetication ticket FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(1, txtUserName.Text, DateTime.Now, DateTime.Now.AddMinutes(10),false, ""); // Now encrypt the ticket. string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
// Create a cookie and add the encrypted ticket to the // cookie as data. HttpCookie authCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket); // Add the cookie to the outgoing cookies collection. authCookie.Expires = DateTime.Now.AddMinutes(10); Response.Cookies.Add(authCookie);
Session.Add("Login", txtUserName.Text); Session.Add("Group",Group) Page.SmartNavigation = false; // Redirect the user to the originally requested page FormsAuthentication.RedirectFromLoginPage(txtUserN ame.Text, false);
Do I need to edit the machine.config?
Thanks, Belle
I'm using the cookie for timeout.....but unless I close the browser a
timeout never occurs!
ok, a stupid question here, but Do i need to explicitly check for a
cookie timeout, or will the "Application_AuthenticateRequest" in
global.asax take care of it.
Please have a look at my global.asax for my app:
protected void Application_AuthenticateRequest(Object sender, EventArgs
e)
{
// Extract the forms authentication cookie
string cookieName = FormsAuthentication.FormsCookieName;
HttpCookie authCookie = Context.Request.Cookies[cookieName];
if(null == authCookie)
{
// There is no authentication cookie.
return;
}
FormsAuthenticationTicket authTicket = null;
try
{
authTicket = FormsAuthentication.Decrypt(authCookie.Value);
}
catch(Exception ex)
{
// Log exception details (omitted for simplicity)
return;
}
if (null == authTicket)
{
// Cookie failed to decrypt.
return;
}
// When the ticket was created, the UserData property was assigned a
// pipe delimited string of group names.
String[] groups = authTicket.UserData.Split(new char[]{'|'});
// Create an Identity object
GenericIdentity id = new
GenericIdentity(authTicket.Name,"LdapAuthenticatio n");
// This principal will flow throughout the request.
GenericPrincipal principal = new GenericPrincipal(id, groups);
// Attach the new principal object to the current HttpContext object
Context.User = principal;
}
Thanks. This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics
by: obhayes |
last post by:
Hi All,
Im using classic ASP (3.0) and I have a web farm with 2 webservers
(webserver A and webserver B, both windows server 2003). I do not want
to store any client specific information on the...
|
by: brad |
last post by:
Hi,
Im using classic ASP (3.0) and I have a web farm with 2 webservers
(webserver A and webserver B, both windows server 2003). I do not want
to store any client specific information on the...
|
by: Joey Powell |
last post by:
Hello, I originally configured my application to use persistent
cookies in error. Now, I need to find a way to disable those cookies.
I have tried changing usernames and passwords for all of the...
|
by: Kepler |
last post by:
I'm testing very basic FormsAuthentication and having trouble with
non-persistent cookies. Once authenticated with a non-persistent
cookie, if I leave the browser alone for 30 minutes,...
|
by: robert |
last post by:
I have noticed in .net 2 that when authenticating a user, setting the
cookie using either redirectfromloginpage or setauthcookie, specifying
true for the persistent parameter that the cookie is...
|
by: sanchita |
last post by:
Hello everyone,
I didn't get any response in "Security" forum hence posting here again.
I am having problem with persistent cookies. Even after setting
"CreatePersistentCookie" to true in...
|
by: GaryDean |
last post by:
I'm using the 2.0 login control with the "remember me" setting. When
checked the cookie only last for a few hours then it is asking again for a
login. I don't see any time settings. I know back...
|
by: rh.krish |
last post by:
I have a typical ASP.NET 2.0 Forms authentication application which
authenticates against Active Directory. I use non-persistent cookie so
that the user is NOT remembered across browser sessions....
|
by: Jason James |
last post by:
Hi,
I am exploring the possibility of using the MSAccess provider for
membership, etc. All is working well, including being able to use it
for webparts, user authentication, etc. I can create...
|
by: emmanuelkatto |
last post by:
Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud.
Please let me know.
Thanks!
Emmanuel
|
by: BarryA |
last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
|
by: nemocccc |
last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
|
by: Sonnysonu |
last post by:
This is the data of csv file
1 2 3
1 2 3
1 2 3
1 2 3
2 3
2 3
3
the lengths should be different i have to store the data by column-wise with in the specific length.
suppose the i have to...
|
by: Hystou |
last post by:
There are some requirements for setting up RAID:
1. The motherboard and BIOS support RAID configuration.
2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
|
by: jinu1996 |
last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...
|
by: tracyyun |
last post by:
Dear forum friends,
With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...
|
by: isladogs |
last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM).
In this session, we are pleased to welcome a new...
| |