Click here to Skip to main content
15,911,039 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I have an application built using MVC 5, we have a scenario where users are redirected to the login page when the default session timeout has elapsed even while the user was still typing on a text box. I want users to be redirected to login page only when a page has been left idle for more than 15 minutes but not when users are very. In web forms, we use to set sliding expiration to true in the config file, but that doesn't work in MVC. I will appreciate any assistance.

What I have tried:

Login Action:

C#
  [HttpPost]
     [AllowAnonymous]

public ActionResult Login(LoginViewModel model, string returnUrl, string command)
   {
      string decodedUrl = "";
      if (!string.IsNullOrEmpty(returnUrl))
          decodedUrl = Server.UrlDecode(returnUrl);
          FormsAuthentication.SetAuthCookie(model.Email, false);

         var authTicket = new FormsAuthenticationTicket(1, user.Email,
         DateTime.Now, DateTime.Now.AddMinutes(15), false, user.Roles);
         string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
         var authCookie = new HttpCookie(FormsAuthentication.FormsCookieName,
         encryptedTicket);
         HttpContext.Response.Cookies.Add(authCookie);
         authCookie.Expires = authTicket.Expiration;

          if (Url.IsLocalUrl(decodedUrl))
              {
                   return Redirect(decodedUrl);
              }
             else
              {
               return RedirectToAction("analytics", "dashboard");
             }
   }


Global ASAX Code:

C#
protected void Application_PostAuthenticateRequest(Object sender, EventArgs e)
        {
            try
            {
        var authCookie = HttpContext.Current.Request.Cookies[FormsAuthentication.FormsCookieName];
                if (authCookie != null)
                {
                    FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);
                    if (authTicket != null && !authTicket.Expired)
                    {
                        var roles = authTicket.UserData.Split(',');
                        HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(new FormsIdentity(authTicket), roles);
                    }
                }
            }
            catch(Exception ex)
            {
                
            }
        }
Posted
Updated 11-Feb-19 6:20am
Comments
Richard Deeming 12-Feb-19 10:27am    
Sliding expiration wouldn't have had any effect in web forms either. The session timeout is only extended when a request hits the server. Unless you've set up a Javascript event handler, that doesn't normally happen when the user is typing on the page.
Uwakpeter 13-Feb-19 3:26am    
thank you sir, it is now i understand how this really works.

1 solution

When users "are very" what?

If it's expired, it's expired.

If the timeout is too short, on average, then extend it.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900