Session timeout does not work ( is set in web.config )

Question

I used the ClaimsIdentity Framework to set up auth in one of my applications.

I added those lines into the web.config file like decribed in this question.

<sessionState
         mode="InProc"
         timeout="1" />

I let the application run overnight, but I was still logged in. I'd like to set the session timeout to 30 minutes, any suggestions ?

ASP.NET MVC Version: 5.2.3.0

What are you using for authorization? Forms, Membership or Identity? — Erik Philips, Mar 08 '16 at 08:58
http://www.jamessturtevant.com/posts/ASPNET-Identity-Cookie-Authentication-Timeouts/ — Erik Philips, Mar 08 '16 at 09:01
@ErikPhilips, thanks that works for me, I'd gladly accept that as an answer, just create one and I'll accept. — AME, Mar 08 '16 at 09:09

score 2 · Accepted Answer · answered Mar 08 '16 at 09:13

Per ASP.Net-Identity-Cookie-Authentication-Timeouts you should be using Identity's UseCookieAuthentication() parameters to set the timeout.

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
  AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
  LoginPath = new PathString("/Account/Login"),
  Provider = new CookieAuthenticationProvider
  {
    OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
        validateInterval: TimeSpan.FromMinutes(15),
        regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager)),
  },
  SlidingExpiration = false,
  ExpireTimeSpan = TimeSpan.FromMinutes(30)
});

CookieAuthenticationOptions.ExpireTimespan is the option that allows you to set how long the issued cookie is valid for. In the example above, the cookie is valid for 30 minutes from the time of creation. Once those 30 minutes are up the user will have to sign back in becuase the SlidingExpiration is set to false.

If SlidingExpiration is set to true then the cookie would be re-issued on any request half way through the ExpireTimeSpan. For example, if the user logged in and then made a second request 16 minutes later the cookie would be re-issued for another 30 minutes. If the user logged in and then made a second request 31 minutes later then the user would be prompted to log in.

is it possible to move these settings from Startup.Auth.cs code to the web.config file (or at least the ExpireTimeSpan alone)? — Alexander Mihailov, Nov 16 '20 at 20:47
@AlexanderMihailov What would prevent you from reading the web.config settings into variables before this code and using those variables to dynamically provide the values for this code? — Erik Philips, Nov 17 '20 at 10:32

Session timeout does not work ( is set in web.config )

1 Answers1

Linked