What is the best way to keep asp.net or asp.net mvc session active until user logs out?
*User should be able to activate session even after browser or computer restarts...
In another words, what is the best way to implement REMEMBER ME...
You can set the timeout setting to a higher value, but you can't make the difference between a session_end caused by a timeout or by a user that ends his session.
The solution to your problem is probably to restore the user's session in the session_start method in Global.asax.
You can use membership provider for this purpose and set a cookie file at the user browser and check it for authentication
Another idea is to send keep-alive request in background via iframe / ajax / image tag every minute or so.
The best way to be able to do this is to use cookies in your authentication strategy to indicate that a user is logged in. Set your website to use forms authentication, and set the pertinent attributes to use cookies. It can be done in your Web.config file:
<authentication mode="Forms">
<forms loginUrl="Login.aspx"
protection="All"
timeout="30"
name="AppNameCookie"
path="/FormsAuth"
requireSSL="false"
slidingExpiration="true"
defaultUrl="default.aspx"
cookieless="UseCookies"
enableCrossAppRedirects="false"/>
</authentication>
For more information read this: How To: Use Membership in ASP.NET 2.0
Related
I have checked various questions asked in SO in this topic also tried the solutions provided for the various questions, but it doesnt work for me.
My application is ASP .Net4.5, I store username, usertype in session and later it is used while inserting data to the SQL tables. I have set the session time out in webconfig as follows.
<system.web>
<authentication mode="Forms">
<forms loginUrl="Login.aspx" name=".mycookie" timeout="60"></forms>
</authentication>
<sessionState mode="InProc" cookieless="false" timeout="60" />
In the IIS settings against Sessionstate the following were set
SessionState = In Process
Cookie settings -> Mode = Use Cookies
Name = ASP.Net_SessionId
Timeout (min) = 60
I'm not sure whether I'm setting this in wrong way in the above settings. The issue is my application session timeouts much before the set time, I feel it gets timeout in 10-15 minutes. Please advise how to set the timeout value correctly.
Probably, you are getting problem with form authentication timeout and session timeout. Please see here.
Try this in web config file.
<system.web>
<authentication mode="Forms">
<forms timeout="50"/>
</authentication>
<sessionState timeout="60" />
</system.web>
I tried setting session timeout, but it didnt worked for me. I decided to store those session variables used in cookies, and read from cookies. Now there is no session timeout issue. I clear the cookies while login to the application, also set the expiry to 1 day to avoid any issue. Thanks for helping me.
I set Sessionstate an Authentication Timeout in web.Config like below , but users are logout less than 20 minutes
<authentication mode="Forms">
<forms defaultUrl="~/Default.aspx" loginUrl="~/Login.aspx" name="Login" timeout="43200" slidingExpiration="true"/>
</authentication>
<sessionState timeout="43200"></sessionState>
First of all I would like to clarify that Authentication has very little to do with Session.
Every time a new user hits the website the session starts.
And the amount of time that the authentication cookie is good for on the user's browser is defined by authentication time out.
You can also try to set the Session timeout by Going to IIS and setting Session timeout there as well
You should disable or increase the application pool timeout in IIS - web site properties.
Regards
I'm having trouble with a site that just went to production. For some reason, although the settings seem to be correct for a 15 minutes session timeout, users are reporting that in about 5 minutes they have to log in again.
What can I check? how can I troubleshoot this? I can't reproduce it locally, or in our QA environment. Are there IIS settings I could check? browser settings on the client?
below is my web.config entry for the authentication. Thanks!
<authentication mode="Forms">
<forms loginUrl="~/admin/Login" cookieless="UseCookies" requireSSL="false" timeout="15" slidingExpiration="true" name="{C8226EAB-2423-45ce-8A1D-3BC227F1BEE9}"/>
</authentication>
You'll need to add a machine key to your web.config file. It' getting autogenerated with each app pool recycle and causing your auth ticket cookie values to fail.
This is similar to the following question:
figuring out why asp.net authentication ticket is expiring
Well I think that you need also to set the settings of domain name. Do not set www.yourdomain.com, because this way if a user get on yourdomain.com is get diferent cookie.
Set it to root name with our the www: yourdomain.com
<authentication mode="Forms">
<forms
path="/"
domain="yourdoman.com" // <- maybe this key is the reason
/>
</authentication>
Make suer the session is set to at least 15 minutes as well in IIS Manager.
In javascript alert(document.cookie); does not show the .ASPXAUTH Cookie although a sniffer is showing it,
I need it because I have an AJAX Request to the server, the request should not take place when the user is already logged in,
if I cannot check .ASPXAUTH for security reason, what I should do to check whether the user is already logged in.
Thanks
The authentication cookie is marked with http-only, meaning it cannot be accessed by javascript. If you want to check is the user is authenticated, simply output a javascript variable, an hidden field or whatever you prefer from your code-behind. You can then check this easily in JS.
There is a .ASPXAUTH cookie set, you are obviously correct. It is used to determine if a user if logged in.
To get what you need look over your web.config for the config section:
<authentication mode="Forms">
<forms
loginUrl="~/login.aspx"
protection="All"
timeout="30"
name="ExampleSite.FormsAuthentication"
path="/"
requireSSL="false"
slidingExpiration="true"
defaultUrl="index.aspx"
cookieless="UseDeviceProfile"
enableCrossAppRedirects="false"
/>
</authentication>
When the user is successfully authenticated a cookie will be set based off the name="ExampleSite.FormsAuthentication" parameter. It will expire after logging out or after the session expires. You will see a cookie on Chrome/FFX or whatever browser you are using called ExampleSite.FormsAuthentication with an encrypted value. Obviously the name parameter you are using will be different and not ExampleSite.FormsAuthentication but you get the idea.
You could always check and see if the cookie exists. As mentioned be careful of the http-only (with relation to JS). As you can also override that value in the web.config so you can access it with JS.
<httpCookies httpOnlyCookies="false" requireSSL="false" domain="" />
I'm trying to increase the timeout on all sessions. The site is hosted with Godaddy, and it is written in Flash (client side of course) and asp.net on the backend. I've added this to my web.config,
<sessionState timeout="720">
</sessionState>
Is that really all that I need to do? I'd prefer to not let sessions expire ever, but I'm sure that the server needs to reclaim that memory at some point...I'm not storing anything in the session, really, just using it to track users' progress through the site, and if a user is logged in or not.
Thanks for any pointers...all the documentation seems deceptively simple, and it kind of makes me nervous...
Yup!
As in; Yes, that's the only thing you need to do...
To get "never ending timeouts" you'd have to create a background HTTP request (which will transmit the session cookie) back to the server every 719 minute though. Though theoretically then you'd also have to have "Out of Process" sessions using e.g. some sort of database or something...
Or you could roll your own session handler, I think APS.NET have support for this through using some sort of adapter pattern or something, but I am not sure. Then you could have a "truly" never ending session...
If you are using Forms Authentication you will also need to set the Forms Authentication Timeout in your web.config
Example:
<authentication mode="Forms">
<forms
name=".ASPXAUTH"
loginUrl="/Home/Default.aspx"
defaultUrl="/Dashboard/Default.aspx"
protection="All"
timeout="30"
slidingExpiration="true"
/>
</authentication>