Home/ Questions/Q 9012163
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T02:55:35+00:00

I have an ASP.NET MVC 3 application that is using windows authentication, configured in

  • 0

I have an ASP.NET MVC 3 application that is using windows authentication, configured in IIS 7.5. It prompts the user for their Windows Credentials when they first load the
page.

Now, I want to have the “session” timeout in XX minutes, so that the page
will again prompt them for their credentials if this timeout has elapsed.

I have tried setting the “Session.timeout = XX” in the page_load method of
the page I want to secure.

I notice that the “Session_End” method in Global.Asax does fire, but the
Authentication Ticket appears to “stay valid” even after the Session has
ended.

Is there a way to force the page to prompt again for Windows Credentials at
specified timeouts either by changing configurations in Web.Config or thru IIS?

Please let me know.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You don’t have control over the allowed session duration when using Windows Authentication, as this is part of the authentication protocol (Kerberos). There are ways and workarounds, but none of them straightforward.

    It seems that forcing a client-side document.execCommand("ClearAuthenticationCache"); might come closest to your needs.

    • 0