Time outs in asp.net web config settings and security

Question

I was researching on forms authentication in ASP.NET and got stuck with the various time-out settings found in a sample code. In the web.config itself two time outs are specified. One is sessionState timeout="30" and under authentication settings forms loginUrl="Login.aspx" protection="All" path="/" timeout="60"

Apart from these, in the login page C# the FormsAuthenticationTicket another time as shown below

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
                       1,
                       tableObject.Rows[0]["UserName"].ToString(),
                       DateTime.Now,
                       DateTime.Now.AddMinutes(40),
                       true,
                       "AuthenticatedUser",
                       FormsAuthentication.FormsCookiePath);

How these time outs are actually working and what is the preferred settings to ensure good protection to the pages?

Rachit Rachit · Accepted Answer · 2014-03-04T11:56:26

HttpSessionState.Timeout Property Gets and sets the amount of time, in minutes, allowed between requests before the session-state provider terminates the session. The Timeout property can be set in the Web.config file for an application using the timeout attribute of the sessionState configuration element, or you can set the Timeout property value directly using application code.

<configuration>
  <system.web>
    <sessionState 
      mode="InProc"
      cookieless="true"
      timeout="30" />
  </system.web>
</configuration>

A session starts every time a new user hits the website, regardless of whether or not they are anonymous. Authentication has very little to do with Session.

On the other hand Authentication timeout (which is under authentication settings )is the amount of time that the authentication cookie is good for on the user's browser. Once the cookie expires, they must re-authenticate to access protected resources on the site.

<system.web>
  <authentication mode="Forms">
    <forms loginUrl="Login.aspx"
           protection="All"
           timeout="30"
           name=".ASPXAUTH" 
           path="/"
           requireSSL="false"
           slidingExpiration="true"
           defaultUrl="default.aspx"
           cookieless="UseDeviceProfile"
           enableCrossAppRedirects="false" />
  </authentication>
</system.web>

So, if Session times out before the Authentication cookie - they are still authenticated, but all their session variables disappear, and may cause errors in your website if you are not disciplined in checking for nulls and other conditions brought about by missing session.

If Authentication times out before the session, then all their session variables will still exist, but they won't be able to access protected resources until they log back in again.

if your session times out after 20 minutes, your session-variables will be lost. but the user could access the pages which are protected by the authentication.

if the authentication times out, the user could not access the page which it protects, and the state of the session is irrelevant.

I just want to add that there is another important timeout setting that exist in IIS at the application pool level. IIS will restart the pool after the specified idle timout has reached, so to make the allocated resources free. You should make sure this pool idle timeout is always greater than the above two mentioned timeouts, or you will get errors regardless of what the session or forms timeout is set to

This stuff is very trivial and you and find more on this on MSDN.

Time outs in asp.net web config settings and security

3 Answers