Using AJAX - Basic Question about Session vs. Forms Authentication Timeout

Question

So I'm using a AJAX to present an exam simulator for a client, where each mock exam is about 2 hours long. I am realizing that I do not know as much about sessions and its relation to forms authentication as I should.

Question: During the course of the exam, AJAX will access code behind, triggering the Page_Load event. As such, does this mean that both the sessionState timeout value, and the Forms Authentication timeout value will be reset?

Kev · Accepted Answer · 2011-01-11 22:04:14Z

1

Each time a request is sent to the application and the current session is still valid the session timeout will be renewed.

Forms Authentication can work in two ways. You can keep a user logged in for a fixed amount of time or use a sliding expiration. For example:

<authentication mode="Forms">
    <forms defaultUrl="~/Default.aspx"
        loginUrl="~/Login.aspx"
        slidingExpiration="false"
        timeout="120" />
</authentication>

The above sets the forms authentication timeout to 120 minutes but also disables the sliding expiration slidingExpiration="false". This will kick a user out after two hours have expired.

FormsAuthentication.SlidingExpiration Property (MSDN Library)

edited Jan 11, 2011 at 22:04

answered Jan 11, 2011 at 21:58

Kev

120k53 gold badges308 silver badges396 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user303644 Over a year ago

Thanks! I've verified this with some tests, but am never quite sure about session timeout's behavior.

Kev Over a year ago

@user303644 - that's quite common :). Just as a last note, it's always good to ensure your session timeout is a tad longer than your Forms Authentication ticket expiry. That makes sure people get booted off before the session expires and you don't have to worry about null session values: stackoverflow.com/questions/4605161#4605218. Oh feel free to upvote me and mark as correct if this answer helped :)

user303644 Over a year ago

Great point- I set the session slightly longer than the authentication ticket. thx again

Phrogz · Accepted Answer · 2011-01-11 21:56:24Z

0

Though it may depend on the server code managing your sessions, the general answer is "Yes". AJAX requests (XmlHttpRequest) will pass along browser cookies, allowing the server to associate the request with a session and consequently re-setting the timer.

If you are managing your sessions through URL instead of cookies, then you will need to ensure that your AJAX requests conform to the URL needs and pass the session_id along with the request.

answered Jan 11, 2011 at 21:56

Phrogz

304k115 gold badges669 silver badges758 bronze badges

2 Comments

user303644 Over a year ago

I am using InProc for sessionState, and have not changed the manner in which forms authentication functions (slidingExpiration is true). I did a small test, setting Forms Authentication timeout to 3, and sessionState timeout to 2, and it looks like everything was adhered to properly (timed out when it was supposed to, persisted when it was supposed to). But I am never quite sure what to rely on when working with invisible timeouts! I'm going to monitor server memory usage this evening to see what type of effect this has. Thanks-

Phrogz Over a year ago

@user303644 Glad to help. You should know that 'thanks' on Stack Overflow are nice to hear as words, but better expressed by upvotes and/or accepted answers :)

Collectives™ on Stack Overflow

Using AJAX - Basic Question about Session vs. Forms Authentication Timeout

2 Answers 2

3 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related