Question

Is there any other reasoning other than the timeout setting in the web.config not being used? It might be the default timeout of 30 minutes but it is definitely less than 30 minutes.

        <authentication mode='Forms'>         <forms timeout='50000000' loginUrl='content/login.aspx'/>     </authentication> 

And for the code behind on my Login.aspx page:

    protected void LoginButton_Click(object sender, EventArgs e) {     if (Membership.ValidateUser(UserName.Text, Password.Text))     {         FormsAuthentication.RedirectFromLoginPage(UserName.Text, RememberMe.Checked);     }     else     {         FailureText.Text = '<br/>Login Failed. Please try again';     }  } 

[Edit]

I believe the timeout occurs around 10 minutes of idleness..

Answer 1

The ASP.NET authentication timeout can be set in the web.config file (as you’ve shown in your question), however, this can also be set in code. Do you have any areas of your C# code that explicitly set the forms timeout value? If so, the setting in code will override the web.config setting.

Another possibility is the use of a code-generated forms authentication cookie. This is usually done, again in the C# code, with something like the following:

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(                                                             name,                                                             isPersistent,                                                             expirationTime); 

If you create a specific FormsAuthenticationTicket with a timeout setting of (for example) 60 minutes, whilst your web.config setting indicates 30 minutes, the ticket set from within code will override the web.config setting.

Please note that the ASP.NET Session and the IIS Session time out values should have no effect on your forms authentication timeouts.

Of course, as a last possibility, since forms authentication is usually based upon a client-side cookie, it could just be possible that the user is clearing/deleting the cookie. This would of course result in the user not being authenticated with your website.

Please also take a look at this post from Scott Forsyth on the weblogs.asp.net site that details these very issues.