Forms Authentication non-persistent cookie not expiring after closing the browser

Joined
Apr 9, 2008
Messages
1
Reaction score
0
I have a typical ASP.NET 2.0 Forms authentication application which authenticates against Active Directory. I use non-persistent cookie so that the user is NOT remembered across browser sessions. The timeout is set to 10 minutes. Here is the important code snippets that I took from my original code:

string roleToCheck = .....;
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, member.UserName, DateTime.Now, DateTime.Now.AddMinutes(10), false, roleToCheck, FormsAuthentication.FormsCookiePath);
string encryptedTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie authSessionCookie = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
authSessionCookie.HttpOnly = true;
authSessionCookie.Expires = ticket.Expiration;
Response.Cookies.Add(authSessionCookie);
FormsAuthentication.RedirectFromLoginPage(txtUserName.Text, false);


Note that I'm setting the 2nd parameter to false which means that it creates non-persistent cookie. Now I opened the IE browser and logged in by entering the user credentials. I closed the window and there was no other instance of IE running. I opened another IE and entered the URL and it straight away went to default page instead of Login page.

1. Why is the cookie not expiring even after I close the browser?
2. If that's how the ASP.NET works, is there any work around so that whenever the user closes IE and opens another IE, he should be forced to login once again?

Thanks,
Hari.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

Forum statistics

Threads
473,981
Messages
2,570,187
Members
46,731
Latest member
MarcyGipso

Latest Threads

Top