FormsAuthenticationTicket expiration

asp.net, c#, cookies, forms-authentication

Solution

The problem with your code is that you're calling `RedirectFromLoginPage`, which will create the forms authentication cookie, overwriting the cookie you've just created:

HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket); 
cookie.Expires = ticket.Expiration; 
Response.Cookies.Add(cookie); 

FormsAuthentication.RedirectFromLoginPage(userName, persistCookie); <-- creates a new cookie

The cookie created by `RedirectFromLoginPage` will of course have the default timeout taken from configuration.

Your second version is the way to go.

Problem

I have been searching the web and found many odd answers and i've tried almost all of them. My problem is this. My login page contains: ``` FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, userName, DateTime.Now, DateTime.Now.AddMinutes(min), persistCookie, userid.ToString()); string encTicket = FormsAuthentication.Encrypt(ticket); HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, encTicket); cookie.Expires = ticket.Expiration; Response.Cookies.Add(cookie); FormsAuthentication.RedirectFromLoginPage(userName, persistCookie); ``` Now the min value is per user based and can be set individually, so is persistCookie. After what i understand this code should result in the possibillity of overriding the default values in web.config. Which should be 30 minutes. ``` <authentication mode="Forms"> <forms loginUrl="~/Default/default.aspx" defaultUrl="~/User/UserMain.aspx"/> </authentication> ``` min is currenlty set to 120, and persistCookie is set too true. When i log in i get timeout at 30 minutes. (Not session, so somewhere expiration date is set, because if it was not set the cookie should be session based, also i do not get 120 minutes which is kind of the deal here) My question, for simplifying it, is how do i get the value 'min' to be the expiry date of the cookie? This might turn out too be a simple thing but i am currently totally stuck so any help would be appriciated. EDIT: I changed the login logic to this: ``` FormsAuthenticationTicket fat = new FormsAuthenticationTicket(1, userName, DateTime.Now, DateTime.Now.AddMinutes(min), persistCookie, userid.ToString()); string encTicket = FormsAuthentication.Encrypt(fat); Response.Cookies.Add(new HttpCookie(FormsAuthentication.FormsCookieName, encTicket) { Expires = fat.Expiration }); Response.Redirect(FormsAuthentication.GetRedirectUrl(userName, false)); ``` And now it works. But i cant seem to figure out why this would work, and not the previous one. Ticket creation is the same, the only difference is that i add Expires property of the HttpCookie when creating the HttpCookie, not after the object is made. If anybody has a good explanation i am all ears! :)

Original source