Session cookie persitance in ASP.NET MVC

Question

This is probably a duplicate question, but since I can't find the answer in the questions from the past I am going to ask again.

In my ASP.NET application, when I authorize the user, I set the custom FormsAuthenticationTicket. The persistance variable is false, so the authentication cookie should only be valid for current session.

My question is when would this session end? I restart my IIS Express development server, I shut down the dev machine, etc, and the session seems to be still active and the user is authenticated with that cookie.

How come in my VS 2012 + IIS Express environment sessions are immortal?

Cookie "sessions" are browser sessions, not server sessions. — Andrew Barber
– Andrew Barber, Commented Aug 22, 2012 at 13:33
Andrew Barber is correct. To end your session close all instances of your browser. Or provide a log out button and click it. — Luke Baughan
– Luke Baughan, Commented Aug 22, 2012 at 13:39

Icarus · Accepted Answer · 2012-08-22 13:42:17Z

2

That's not an issue. You can restart the server and as long as the authentication cookie is still valid, the user is considered logged in. Remember, HTTP is a disconnected protocol.

The cookie will be removed the moment the user logs out and you programmatically remove the cookie or when the user closes his browser.

answered Aug 22, 2012 at 13:42

Icarus

64k14 gold badges102 silver badges116 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Session cookie persitance in ASP.NET MVC

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related