Controlling the FormsAuthentication createPersistentCookie expiration

Question

In an ASP.NET MVC2 app, we have the standard login action...

if (ValidateUser(model.Email, model.Password)
{
  FormsAuthentication.SetAuthCookie(model.Email, model.RememberMe);
  ...

where the second parameter to SetAuthCookie is createPersistentCookie with the following documentation:

createPersistentCookie
  Type: System.Boolean
    true to create a persistent cookie
    (one that is saved across browser sessions); otherwise, false.

We would like to have the persistent cookie expire after 2 weeks (i.e., a user could return to the site within 2 weeks and not be required to re-authenticate. After that time they would be asked to login again).

How do we set the expiration for the persistent cookie?

Answer 1

Can you not do this?

<system.web>
    <authentication mode="Forms">
          <forms timeout="20160"/>
    </authentication>
</system.web>

The timeout is in minutes.

This timeout value is irrespective of whether or not you are creating a persistent cookie. It simply says that if you don't explicitly terminate the cookie (FormsAuthentication.SignOut), it will automatically expire after the given time period.

In other words, if you do:

FormsAuthentication.SetAuthCookie(someMembershipName, false);

Will result in the cookie expiring when:

• The user closes the browser, or
• The timeout is reached.

As opposed to if you do:

FormsAuthentication.SetAuthCookie(someMembershipName, true);

Will result in the cookie only expiring when the timeout is reached.

HTH

EDIT:

Take from MSDN:

the timeout attribute is described as follows:

Specifies the time, in integer minutes, after which the cookie expires. If the SlidingExpiration attribute is true, the timeout attribute is a sliding value, expiring at the specified number of minutes after the time that the last request was received. To prevent compromised performance, and to avoid multiple browser warnings for users who have cookie warnings turned on, the cookie is updated when more than half of the specified time has elapsed. This might cause a loss of precision. The default is "30" (30 minutes).

Note Under ASP.NET V1.1 persistent cookies do not time out, regardless of the setting of the timeout attribute. However, as of ASP.NET V2.0, persistent cookies do time out according to the timeout attribute.

In other words, this expiration setting handles the Forms Authentication cookie only.

The Forms Authentication cookie is a client-side cookie, it has nothing to do with other server-side session you may have (ie a Shopping Cart).

That Session is expired with the following setting:

<sessionstate 
      mode="inproc"
      cookieless="false" 
      timeout="20"