How do I Keep a user logged in for 2 weeks?

Question

HI

I am using asp.net mvc with asp.net membership.

I want to have a checkbox that if clicked keeps the users signed in for 2 weeks(unless they clear their cookies).

So I know their is

FormsAuthentication.SetAuthCookie(userName, createPersistentCookie)

but I don't know how to set it up for 2week retention.

I rewrote most of the membership stuff. So I don't use stuff like Create() and VerifyUser().

Answer 1

Add a secret hash key of a random string to both the cookie and the database (both the same key). If the cookie and database value are the same, when the user starts a new session, sign him/her in again. When the user reaches the two weeks, remove the secret key from the database using a cronjob (Unix) or scheduled task (Windows).

Warning: Do not rely on the cookie expire date, since people can hack their browser.

Answer 2

Just use a simple session cookie with 2 weeks expiration date.

Answer 3

Have you seen this?

http://forums.asp.net/t/1440824.aspx

Along similar lines to what Koning has suggested.

Answer 4

You can set the global session timeout (the value is in minutes) in web.config eg.

<system.web>
    <authentication mode="Forms">
          <forms timeout="20160"/>
    </authentication>
</system.web>

This will be for all authenticated users. If you want to use the 'Remember Me' functionality then you will need to write your own code to set the cookie/ticket. Something like this (taken from here):

protected void Page_Load()
{
 if (Request.Cookies["username"] == null || Request.Cookies["username"].Value.ToString().Trim() == "")
{
Login1.RememberMeSet = true; 
}
else
{
Login1.UserName = Request.Cookies["username"].Value.ToString().Trim();
Login1.RememberMeSet = true; 
}
}
protected void RememberUserLogin()
{
// Check the remember option for login

if (Login1.RememberMeSet == true)
{
HttpCookie cookie = new HttpCookie("username");
cookie.Value = Login1.UserName.Trim(); 
cookie.Expires = DateTime.Now.AddHours(2);

HttpContext.Current.Response.AppendCookie(cookie);
Login1.RememberMeSet = true; 

}
else if (Login1.RememberMeSet == false)
{
HttpContext.Current.Response.Cookies.Remove("username");
Response.Cookies["username"].Expires = DateTime.Now;
Login1.RememberMeSet = false; 
}

}

Answer 5

Instead of writing new stuff, how about implementing OpenID?