Services
Technology Web App Development Mobile App Development Windows App Development Database Development UI/UX Development Cloud Development SEO Digital Marketing Guest Posting Content Writing Artificial Intelligence Data Science ERP Development CRM Development CMS Development LMS Development Business Listing Blockchain Technology Startup Promotion AI Tools Integration
Products
Data Converter Cleaner TUC - Unit Converter Import Export Survey Manager Tweet Controller
Developer
Article Blog Forum Interview Beginner News Startup Quiz
Users
Career
Apply Job Internship
Pricing
Login Sign Up Get a Quote

interview

Home Interviews How can you configure Forms Authentication to expire after a certain time or use sliding expiration? – MindStick
Ask Question

1 Answers

ICSM Computer
ICSM Computer 02 Jun 2025
Report Abuse

You can configure Forms Authentication in ASP.NET to expire after a certain time and optionally use sliding expiration by setting attributes in the <forms> element of your web.config.

Configuration in web.config

<system.web>
  <authentication mode="Forms">
    <forms
      name=".AUTH"
      timeout="30"
      slidingExpiration="true"
      requireSSL="true"
      protection="All"
      path="/"
      cookieless="UseCookies" />
  </authentication>
</system.web>

Explanation of Key Attributes

Attribute Description
timeout="30" The duration (in minutes) the authentication ticket is valid. After this period, the cookie becomes invalid.
slidingExpiration="true" Extends the expiration time with each request made within the timeout window.
slidingExpiration="false" The ticket will expire exactly timeout minutes after creation, no matter how many requests are made.
requireSSL="true" Ensures the cookie is only sent over HTTPS.
protection="All" Ensures the ticket is both encrypted and signed.
cookieless="UseCookies" Ensures the authentication token is stored in cookies and not in the URL.

Example Behavior

  • With timeout="30" and slidingExpiration="true":
    • If the user is active, the expiration is pushed 30 minutes ahead with each request.
    • If the user is idle for 30+ minutes, they’ll need to log in again.
  • With slidingExpiration="false":
    • The ticket always expires 30 minutes after issuance regardless of activity.

Best Practices

  • Use slidingExpiration="true" to enhance user experience for active users.
  • Use shorter timeouts (e.g., 10–30 minutes) for sensitive applications.
  • Consider renewing the ticket manually if you implement custom authentication logic.
MindStick Training
Markdown for AI

A clean, structured version of this page for AI assistants and LLMs.

Open .md