---
title: "How can you configure Forms Authentication to expire after a certain time or use sliding expiration?"  
description: "How can you configure Forms Authentication to expire after a certain time or use sliding expiration?"  
author: "ICSM Computer"  
published: 2025-06-02  
updated: 2025-06-05  
canonical: https://www.mindstick.com/interview/34196/how-can-you-configure-forms-authentication-to-expire-after-a-certain-time-or-use-sliding-expiration  
category: "c#"  
tags: ["c#", "authentication"]  
reading_time: 3 minutes  

---

# How can you configure Forms Authentication to expire after a certain time or use sliding expiration?

You can configure **Forms Authentication** in ASP.NET to **expire after a certain time** and optionally use **sliding expiration** by setting attributes in the `<forms>` element of your `web.config`.

### Configuration in `web.config`

```xml
<system.web>
  <authentication mode="Forms">
    <forms
      name=".AUTH"
      timeout="30"
      slidingExpiration="true"
      requireSSL="true"
      protection="All"
      path="/"
      cookieless="UseCookies" />
  </authentication>
</system.web>
```

### Explanation of Key Attributes

| Attribute | Description |
| --- | --- |
| `timeout="30"` | The duration (in minutes) the authentication ticket is valid. After this period, the cookie becomes invalid. |
| `slidingExpiration="true"` | Extends the expiration time with each request made within the timeout window. |
| `slidingExpiration="false"` | The ticket will expire exactly `timeout` minutes after creation, no matter how many requests are made. |
| `requireSSL="true"` | Ensures the cookie is only sent over HTTPS. |
| `protection="All"` | Ensures the ticket is both encrypted and signed. |
| `cookieless="UseCookies"` | Ensures the authentication token is stored in cookies and not in the URL. |

### Example Behavior

- With `timeout="30"` and `slidingExpiration="true"`:

   - If the user is active, the expiration is pushed 30 minutes ahead with each request.
   - If the user is idle for 30+ minutes, they’ll need to log in again.

- With `slidingExpiration="false"`:

   - The ticket always expires 30 minutes after issuance regardless of activity.

### Best Practices

- Use `slidingExpiration="true"` to enhance user experience for active users.
- Use shorter timeouts (e.g., 10–30 minutes) for sensitive applications.
- Consider renewing the ticket manually if you implement custom authentication logic.

## Answers

### Answer by ICSM Computer

You can configure **Forms Authentication** in ASP.NET to **expire after a certain time** and optionally use **sliding expiration** by setting attributes in the `<forms>` element of your `web.config`.

### Configuration in `web.config`

```xml
<system.web>
  <authentication mode="Forms">
    <forms
      name=".AUTH"
      timeout="30"
      slidingExpiration="true"
      requireSSL="true"
      protection="All"
      path="/"
      cookieless="UseCookies" />
  </authentication>
</system.web>
```

### Explanation of Key Attributes

| Attribute | Description |
| --- | --- |
| `timeout="30"` | The duration (in minutes) the authentication ticket is valid. After this period, the cookie becomes invalid. |
| `slidingExpiration="true"` | Extends the expiration time with each request made within the timeout window. |
| `slidingExpiration="false"` | The ticket will expire exactly `timeout` minutes after creation, no matter how many requests are made. |
| `requireSSL="true"` | Ensures the cookie is only sent over HTTPS. |
| `protection="All"` | Ensures the ticket is both encrypted and signed. |
| `cookieless="UseCookies"` | Ensures the authentication token is stored in cookies and not in the URL. |

### Example Behavior

- With `timeout="30"` and `slidingExpiration="true"`:

   - If the user is active, the expiration is pushed 30 minutes ahead with each request.
   - If the user is idle for 30+ minutes, they’ll need to log in again.

- With `slidingExpiration="false"`:

   - The ticket always expires 30 minutes after issuance regardless of activity.

### Best Practices

- Use `slidingExpiration="true"` to enhance user experience for active users.
- Use shorter timeouts (e.g., 10–30 minutes) for sensitive applications.
- Consider renewing the ticket manually if you implement custom authentication logic.


---

Original Source: https://www.mindstick.com/interview/34196/how-can-you-configure-forms-authentication-to-expire-after-a-certain-time-or-use-sliding-expiration

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.