October 2010
Intermediate to advanced
1920 pages
73h 55m
English
By default, Forms authentication uses a sliding expiration policy. As long as a user lets no more than 30 minutes pass without requesting a page, the user continues to be authenticated. However, if the user does not request a page for 30 minutes, the user is logged out automatically.
If you have strict security requirements, you can use an absolute expiration policy rather than a sliding expiration policy. In other words, you can force a user to log in again after a particular interval of time.
The web configuration file in Listing 27.4 forces a user to log in again every minute.
Listing 27.4. Web.Config
Read now
Unlock full access