Question

I defined a Controller to force authentication by using the [Authorize] attribute. When a session times out, the request is still passed down and executed instead of forcing a redirect.

I do use FormsAuthentication to login and logoff users.

Any ideas on how to control that?

Example:

[Authorize] public class ProjectsController : Controller {     public ActionResult Index()     {         return View();     } } 

Answer 1

Again, ASP.NET MVC builds on top of traditional ASP.NET. Yes, there is an ‘built authentication shizzle’… it’s the exact same Membership API that traditional ASP.NET uses.

Meaning… something else is the problem here. Maybe you have sliding sessions turned on… or maybe the timeout is higher than you thought, etc.