FormsAuthenticationTicket expiration

Question

I have been searching the web and found many odd answers and i've tried almost all of them. My problem is this. My login page contains:

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, userName, DateTime.Now, DateTime.Now.AddMinutes(min), persistCookie, userid.ToString());
string encTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket);
cookie.Expires = ticket.Expiration;
Response.Cookies.Add(cookie);

FormsAuthentication.RedirectFromLoginPage(userName, persistCookie);

Now the min value is per user based and can be set individually, so is persistCookie.

After what i understand this code should result in the possibillity of overriding the default values in web.config. Which should be 30 minutes.

<authentication mode="Forms">
  <forms loginUrl="~/Default/default.aspx" defaultUrl="~/User/UserMain.aspx"/>
</authentication>

min is currenlty set to 120, and persistCookie is set too true. When i log in i get timeout at 30 minutes. (Not session, so somewhere expiration date is set, because if it was not set the cookie should be session based, also i do not get 120 minutes which is kind of the deal here)

My question, for simplifying it, is how do i get the value 'min' to be the expiry date of the cookie?

This might turn out too be a simple thing but i am currently totally stuck so any help would be appriciated.

EDIT: I changed the login logic to this:

FormsAuthenticationTicket fat = new FormsAuthenticationTicket(1, userName, DateTime.Now, DateTime.Now.AddMinutes(min), persistCookie, userid.ToString());
string encTicket = FormsAuthentication.Encrypt(fat);
Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket) { Expires = fat.Expiration });
Response.Redirect(FormsAuthentication.GetRedirectUrl(userName, false));

And now it works. But i cant seem to figure out why this would work, and not the previous one. Ticket creation is the same, the only difference is that i add Expires property of the HttpCookie when creating the HttpCookie, not after the object is made.

If anybody has a good explanation i am all ears! :)

Answer 1

The problem with your code is that you're calling RedirectFromLoginPage, which will create the forms authentication cookie, overwriting the cookie you've just created:

HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket); 
cookie.Expires = ticket.Expiration; 
Response.Cookies.Add(cookie); 

FormsAuthentication.RedirectFromLoginPage(userName, persistCookie); <-- creates a new cookie

The cookie created by RedirectFromLoginPage will of course have the default timeout taken from configuration.

Your second version is the way to go.

Answer 2

I think you don't understand the difference between cookie expiration and ticket expiration dates - ticket can be considered as expired even if the cookie it is being stored in is still valid. The 4th param of FormsAuthenticationTicket constructor is responsible for the ticket expiration date.

So, to answer your question, you need to manually set expiration date of your cookie or make it long enough to exceed expiration date of your authentication ticket.