Handle Session Timeouts and Forms Authentication Timeouts in ASP.NET 2.0

Problems arise when we attempt to set the forms authentication timeout to a long period of time so that users don’t have to log in every time they return to our site. In this case we tend to run into issues with users being logged in even after their session has expired.

It would be much simpler if we just set the forms authentication timeout to a time that was less than the session timeout. In this case, if the user was inactive for too long, they would be redirected to the log in page. Upon redirection to the login page you could clean up and end their session. However, if we want to allow the user to be automatically logged in on return visits, this isn’t a very good solution. In addition there are other unpleasant scenarios that can occur in this model. Take for instance the following example.

You have a user that logs into your web application and goes into edit mode on one of your webforms. When the user enters edit mode, you store a business class object in a session variable for use while they’re working with that form. The user then gets a phone call and begins a lengthy conversation about selling their house or something. While they are on the phone, the forms authentication ticket expires. The user gets off the phone and enters data into more of the fields on form and then hits save. Boom, the user gets redirected to the login page because their authentication ticket expired. They loose the data they had finished entering and aren’t very happy about it.

The solution I implemented to handle these scenarios more gracefully, is to automatically end the users session, log them out and send them to the login page when their session is about to expire.

This solution is specific to the use of a master page throughout your application. If you’re not using a master page, it would be possible to create a user control that you drop on every page to implement the same functionality. However, why not just use a master page.

In my Default.master.vb I have the following two variables declared at a module level.

Protected mintTimeout As Integer
Protected mstrLoginURL As String

Then in the Page_Init of the Default.master.vb I set the two variables.

Dim intRedirectTime As Integer = 2
mintTimeout = (Session.Timeout - intRedirectTime) * 60000
mstrLoginURL = ResolveUrl("~/endsession.aspx")

The variable intRedirectTime represents how many minutes prior to the session timeout that I want to force the redirect to the login page.

60000 represents 1minute in milliseconds. I’ll be using the window.setTimeout method so I need time in milliseconds. Every time there is a postback in the application the above code is run and sets the timeout variable to 2 minutes less than the session timeout setting. I also set the mstrLoginURL with a resolved URL for my endsession.aspx page.

Then on the Default.master just before the end body tag , I put the following JavaScript section.

In the above javascript section the setTimeout method fires 2 minutes before the session is about to end. The endSession function is called which pops up an alert to notify the user that their session has ended. At this point the session is still active, but will be ended regardless once the Ok button is clicked on the alert dialog. In addition the user will be logged out using the FormsAuthentication.SignOut() method.

The page that the user is actually sent to is a blank page with the following code in the Page_Load. I have named the page endsession.aspx.

If User.Identity.IsAuthenticated = True Then
FormsAuthentication.SignOut()
End If
Session.Abandon()
Response.Redirect("~/Login.aspx")

In the above code I check to see if the user is authenticated before trying to sign them out. I then call the Session.Abandon method and redirect them to the login page.

The solution shows what is possible with a little creativity for handling timeout issues in ASP.NET 2.0 web applications. Every application is different and may require unique solutions for handling issues that arise from the new security model in ASP.NET 2.0. I hope this article inspires ideas for others to solve the session issues they may face.

If you have any thoughts, ideas, or input on this subject, please tell me about it by leaving a comment.