How can you configure Forms Authentication to expire after a certain time or use sliding expiration?

Question

ICSM Computer · Answer

You can configure Forms Authentication in ASP.NET to 
expire after a certain time and optionally use sliding expiration by setting attributes in the
andlt;formsandgt; element of your web.config.
Configuration in web.config
andlt;system.webandgt;
  andlt;authentication mode="Forms"andgt;
    andlt;forms
      name=".AUTH"
      timeout="30"
      slidingExpiration="true"
      requireSSL="true"
      protection="All"
      path="/"
      cookieless="UseCookies" /andgt;
  andlt;/authenticationandgt;
andlt;/system.webandgt;
Explanation of Key Attributes
Attribute
Description
timeout="30"
The duration (in minutes) the authentication ticket is valid. After this period, the cookie becomes invalid.
slidingExpiration="true"
Extends the expiration time with each request made within the timeout window.
slidingExpiration="false"
The ticket will expire exactly timeout minutes after creation, no matter how many requests are made.
requireSSL="true"
Ensures the cookie is only sent over HTTPS.
protection="All"
Ensures the ticket is both encrypted and signed.
cookieless="UseCookies"
Ensures the authentication token is stored in cookies and not in the URL.
Example Behavior
With timeout="30" and slidingExpiration="true":
If the user is active, the expiration is pushed 30 minutes ahead with each request.If the user is idle for 30+ minutes, they’ll need to log in again.
With slidingExpiration="false":
The ticket always expires 30 minutes after issuance regardless of activity.
Best Practices
Use slidingExpiration="true" to enhance user experience for active users.Use shorter timeouts (e.g., 10–30 minutes) for sensitive applications.Consider renewing the ticket manually if you implement custom authentication logic.

interview

How can you configure Forms Authentication to expire after a certain time or use sliding expiration?

ICSM Computer

Can you answer this question?

1 Answers

Configuration in `web.config`

Explanation of Key Attributes

Example Behavior

Best Practices

Liked By

Attribute	Description
`timeout="30"`	The duration (in minutes) the authentication ticket is valid. After this period, the cookie becomes invalid.
`slidingExpiration="true"`	Extends the expiration time with each request made within the timeout window.
`slidingExpiration="false"`	The ticket will expire exactly `timeout` minutes after creation, no matter how many requests are made.
`requireSSL="true"`	Ensures the cookie is only sent over HTTPS.
`protection="All"`	Ensures the ticket is both encrypted and signed.
`cookieless="UseCookies"`	Ensures the authentication token is stored in cookies and not in the URL.