Manually renew forms authentication ticket:

Question

Yet another problem with forms authentication ticket expiring too soon. I need to use sliding Expiration set to true. I have read forums and understood the problem with the loss of precision, that the ticket only gets updated if the request is made after half of the expiration time only.

The problem: In my webconfig I have as follows:

    <authentication mode="Forms">
        <forms timeout="20" name="SqlAuthCookie" protection="All" slidingExpiration="true" />
    </authentication>
    <sessionState timeout="20" />
    <authorization>

The user must only be logged out and redirected to login.aspx, only when there was no request made in the 20 Minute interval. The problem is that users are making requests, and still get thrown to the login page. This should not happen. What I thought of doing, was to reset the SqlAuthCookie manually for each request.

Below is my code. It is called on context.AcquireRequestState.

    void context_AcquireRequestState(object sender, EventArgs e)
    {
        HttpContext ctx = HttpContext.Current;
        ResetAuthCookie(ctx);
     }

            private void ResetAuthCookie(HttpContext ctx)
    {
        HttpCookie authCookie = ctx.Request.Cookies[FormsAuthentication.FormsCookieName];
        if (authCookie == null)
            return;

        FormsAuthenticationTicket ticketOld = FormsAuthentication.Decrypt(authCookie.Value);
        if (ticketOld == null)
            return;

        if (ticketOld.Expired)
            return;

        FormsAuthenticationTicket ticketNew = null;
        if (FormsAuthentication.SlidingExpiration)
           ticketNew = FormsAuthentication.RenewTicketIfOld(ticketOld);

        if (ticketNew != ticketOld)
            StoreNewCookie(ticketNew, authCookie, ctx);
    }

    private void StoreNewCookie(FormsAuthenticationTicket ticketNew, HttpCookie authCookie, HttpContext ctx)
    {
        string hash = FormsAuthentication.Encrypt(ticketNew);
        if (ticketNew.IsPersistent)
            authCookie.Expires = ticketNew.Expiration;

        authCookie.Value = hash;
        authCookie.HttpOnly = true;

        ctx.Response.Cookies.Add(authCookie);
    }

My questions are:

1. Is it wrong or an acceptable solution, resetting the cookie on each request?
2. Why does it still not work? It seems that new Ticket never gets renewed.
3. Are there other causes possible, for the fact that the users have their forms authentication expired too soon, that I should investigate?

Thank you, Regards,

Amen

what version of framework and IIS you are using? – Seating

target framework for the project is 4.0. IIS version is 7, but I'm testing on the visual studio 2010 built-in webserver – Amen

I think you should give domain attribute in forms tag. No need to write renewing cookie on every request – Seating

kindly elaborate on the reason why the cookie should not be renewed on each request. i'm just checking the documentation on the domain attribute, and i don't see how that could help solve the issue. thank you – Amen

Answer 1

A forms authentication cookie only renews itself after half it's expiration time has passed.

From Microsoft:

If the Web page is accessed before half of the expiration time passes, the ticket expiration time will not be reset. For example, if any Web page is accessed again at 5:04 00:00:00 PM, the cookies and ticket timeout period will not be reset.

To prevent compromised performance, and to avoid multiple browser warnings for users that have cookie warnings turned on, the cookie is updated when more than half the specified time has elapsed.

This may be your issue. If your clients access your site at the 9 minute mark and don't access it again for 10 minutes they'll be timed out. This occurs even though you have your session timeout set to 20 minutes.

Manually renewing your ticket like you're doing isn't necessary. You just need sliding expiration enabled. If the 'half the specific time' rule doesn't work for you then you'll have to look at other solutions.

Zwart

We ran it the same problem. I ran into MS article before this article. Bulk of the info is here. support.microsoft.com/en-us/kb/910443 – Slaveholder