Forms Authentication Error

[schwarem]

I have an application using forms authentication. When the Session times out, it just clears all the session variables and does not force the user to log back in. Now the user is essentially logged in without any credentials. What is causing the forms authentication to not force the user to log in?

 

[dvannoy]

you can check if the session has expired and then redirect them to another page.

 

[adamroof]

the redirect should be set in the web.config i thot.
and a deny unknown users

are you sure you are setup right in the config?

    <authentication mode="Forms">
      <forms protection="All" timeout="90" slidingExpiration="true" loginURL="login.aspx">
      </forms>
    </authentication>
    <authorization>
      <deny users="?" />
    </authorization>

 

[schwarem]

Here is the section of the web.config file I have.

		<authentication mode="Forms">
			<forms name=".DOCAPP" loginUrl="login.aspx" slidingExpiration="true" protection="All" path="/" timeout="30"/>
		</authentication>
		<authorization>
			<deny users="?"/>
		</authorization>

The session ends properly. It loses the session variables, but it does not force the user to log back in.