Forms Authentication Timeout Clarification

[romh]

I found this definition of timeout from this site

http://www.ondotnet.com/pub/a/dotnet/2003/01/06/formsauthp1.html

This is the amount of time (in integer minutes) that the cookie has until it expires. The default value for this attribute is 30 (thus expiring the cookie in 30 minutes).
The value specified is a sliding value, meaning that the cookie will expire n minutes from the time the last request was received.


What does the last request mean. Does mean the last time there was any activity in the site? Let's say that the timeout is set to 5 minutes. I understand that if the user leaves his desk, and comes back 5 minutes later, he will be redirected to login screen. But what if he is working for more than 5 minutes? Will it cut him off 5 minutes later?

 

[ca8msm]

It means "any form of interaction with the server". e.g. a postback.

So yes it may cut him off if he is simply working on a page (how would the cookie know he is "working"?).

----------------------------------------------------------------------

Need help finding an answer?

Try the search facilty (

http://www.tek-tips.com/search.cfm)

or read FAQ222-2244 on how to get better results.

 

[romh]

Thanks. That answers my question. If I set the timeout value high enough, I am guaranteed to not cut him off. Of course, high enough means not more than that person would work on that page. Maybe 1 hour, 2 hours, etc...

 

[ca8msm]

I think you can also set it to 0 so that it only expires when the session ends (i.e. when the browser closes).

----------------------------------------------------------------------

Need help finding an answer?

Try the search facilty (

http://www.tek-tips.com/search.cfm)

or read FAQ222-2244 on how to get better results.

 

[romh]

Oh really, I didn;t know that. I will look into that. Thanks