Question

I’m using Membership features in my application and I have the following logIn code:

if (!Membership.ValidateUser(email, password))
{
    ViewBag.Message = "E-mail ou senha estão incorretos.";
    return View();
}
else
{
    FormsAuthentication.Authenticate(email, password);
    var keep = keepMeLoggedIn == "true,false" ? true : false;
    FormsAuthentication.SetAuthCookie(email, keep);
    return Redirect("~/Home/Mural");
}

From yesterday to now, when I openned my app again, I was not logged in…
I heard about that when you generate a persistent cookie the session never expires, is that true? What I’m doing wrong? Should I put some information else in web.config?

<authentication mode="Forms">
  <forms name=".ASPXAUTH" loginUrl="~/Usuario/Login" protection="All" timeout="360"   cookieless="UseDeviceProfile" />
</authentication>

Anybody can help?

Answer 1

var keep = keepMeLoggedIn == "true,false" ? true : false;

This code worries me a little. However, I don’t think that is causing the problem.

But, a persistent cookie has an expiration (timeout) which is determined, in what you showed, the authentication tag.

The only difference between a session cookie and a persistent cookie, is that a session cookie will expire if the user closes the browser or when it is timed out. A persistent cookie will only expire when it is timed out.

The second parameter of SetAuthCookie is whether or not to create a persistent cookie. If false, it will be a session, if true, it will be persistent.