Forms Authentication probem

[s2001]

hello all,

I am having trouble with forms authentication. Any help would be greatly appreciated. I am setting the forms auth expiration to 2 minutes. But even after 2 minutes of inactivity in the home page it does not take me back to the login.aspx page. Am i missing something here?

Here's my vb.net code:

Login.aspx page
--------------------------------------------------------

Protected Sub button1_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles RollOver1.Click
         If CheckUser(LogonUser, passwordUser) Then
		SetFormsAuthentication(LogonUser)
	            Response.Redirect("../Common/Default.aspx", True)
            End If
        Catch ex As Exception
            lblmessage.Text = ex.Message
        End Try
End Sub

private function checkuser(username as string, password as string)
       'if sql authenticated then returns true..else raises and error.
end function


Private Sub SetFormsAuthentication(ByVal username As String)
        FormsAuthentication.Initialize()
        Response.Cookies.Clear()
        Dim expiration As Integer=2
        
        Dim dt As DateTime = DateTime.Now
        Dim dte As DateTime = dt.AddMinutes(expiration)

        Dim tkt As FormsAuthenticationTicket = New FormsAuthenticationTicket(username, False, expiration)
        Dim cookiestr As String = FormsAuthentication.Encrypt(tkt)
        Dim ck As HttpCookie = New HttpCookie(FormsAuthentication.FormsCookieName, cookiestr)
        Response.Cookies.Set(ck)
End Sub

'--------------------------------------------------------

My Web config file:

<authentication mode="Forms">
<forms name=".ASPXAUTH" loginUrl="../common/logon.aspx" path="/" protection="All" timeout="30" slidingExpiration="true" />
</authentication>

Thanks,
MB

 

[TipGiver]

Hi,
please fix the code...

. You missed a 'try', and the function 'checkuser' is not a function at all. Add the missing 'As Boolean'. You do not need to raise an exception for unauthenticated users. simply return false.

. The timeout below is set to 30, and not 2 minutes.

. I think that if the auth cookie has expired then a refresh of the page should lead back to the login page if everything is set correctly. Also you can add in page init or load something like : (not sure if it works)
if not user.isauthenticated then
'redirect to login page
end if

 

[s2001]

thanks tipgiver.
I will fix the issues that you pointed out. I have changed the web config timeout to 2 mins. Still having the same problem. I have button control on the Default.aspx page which executes some sql statements. Even after 2 minutes of inactivity, if i click on the button it still executes.

Also do i really need to add user.isauthenticated tag? I have like 50 webpages..

Thanks,
MB

 

[TipGiver]

Hi,

You do not need to add it as soon as the authentication settings are set correctly. I will have to run some tests in order to help you more.