Question

I am currently adding an action filter to handle session timeout in our site:

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
public class SsoExpireFilterAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        if(!(filterContext.Controller.GetType() == typeof(HomeController) 
            && filterContext.ActionDescriptor.ActionName == MVC.Home.ActionNames.Index))
        {
            if(filterContext.ActionDescriptor.ActionName != MVC.Home.ActionNames.TimeoutRedirect.ToLower())
            {
                if (!Thread.CurrentPrincipal.Identity.IsAuthenticated)
                {
                    if (filterContext.HttpContext.Request.IsAjaxRequest())
                        filterContext.Result = new JsonResult { Data = "_Logon_" };
                    else
                        filterContext.Result = new RedirectToRouteResult(
                            new RouteValueDictionary
                        {
                            {"Controller", "Home"},
                            {"Action", "TimeoutRedirect"}
                        });
                }
            }
        }

        base.OnActionExecuting(filterContext);
    }
}

I am expecting the IsAuthenticated flag on Principal.Identity to be false following timeout, however it is remaining true when it is hit in the action filter. (I know the session has timed out as I have put a break point on the Session_End in Global.asax and this is hit first).

The authentication for our site is handled by a company standard “Single Sign On” dll, so I’m guessing that this is setting a separate authentication timeout, does this sound likely?

Any help is appreciated.

Answer 1

Possibly a bit of a cop out, but after consulting with other teams in the business I am going to follow the model of other sites that use the corporate “Single Sign On” dll and use a Session.KeepAlive method so I’ll have no need for this action filter.