Forms Authentication Timeout Logging

Question

I want to detect when a asp.net Form Authentication ticket has expired. I then want to log to the server the user that was signed out because of inactivity. Is there an event that fires on the server when the authentication ticket has expired?

<sessionState mode="InProc" timeout="5"></sessionState>
<authentication mode="Forms">
  <forms loginUrl="~/Home/AccessDenied" timeout="5" />
</authentication>

In the global asax file, I have tried the Session_OnEnd(). But the context.user object is null. When i call membership.getuser() it returns null also. I have tried making the session timeout before the auth but that doesn't help. I am using mvc3 and ii7.5.

I added a timer on the client. It pops up a notification that tells the user they have been inactive for some time. If they want to extend their session then I send an ajax post to the server and do an update on the Membership User object. Which extends their forms authentication session. I am open to other suggestions — Ryand.Johnson
– Ryand.Johnson, Commented Nov 3, 2011 at 17:13
You could use a combination of this method to determine the timeout by reading the ticket and adding that value to the javascript that goes to the page. — Adam Tuliper
– Adam Tuliper, Commented Nov 3, 2011 at 18:24

Community · Accepted Answer · 2017-05-23 12:22:13Z

3

Session and forms authentication have two completely separate timeouts. See my posting on this here:

How can I handle forms authentication timeout exceptions in ASP.NET?

In Application_PreRequestHandlerExecute you need to check the ticket.

Also be sure your session and forms auth timeouts are in sync using the code I posted there. Not just setting both to say 60 minutes. Since forms auth doesn't update the 'touched' time until half of the time passes by, and session time is updated on every request, they get out of sync.

edited May 23, 2017 at 12:22

CommunityBot

11 silver badge

answered Oct 17, 2011 at 17:42

Adam Tuliper

30.2k4 gold badges56 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Ryand.Johnson Over a year ago

Thanks for your response. I am trying to find out when the forms auth ticket expires. Your solution works if they click on another page. But if they close the browser, i do not know when the form auth ticket expires.

Adam Tuliper Over a year ago

You wont. the ticket isnt held on the server. The server knows nothing about the ticket. Its completely held on the client side, which is a reason these were hacked with the POET vulnerability a year ago. It is only checked when you send it to the server with a request (or lack thereof on a request)

Ryand.Johnson Over a year ago

It was not possible as Adam stated. To work around it, I used Jquery to count down when a user stopped interacting with the site. Then i popped up a dialog once their session was about to expire. If they clicked 'extend' then I sent an AJAX call to the server. The call called membership.updateuser which extended the timeout for the forms auth ticket.

Collectives™ on Stack Overflow

Forms Authentication Timeout Logging

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related