How do I stop ASP.net forms authentication / session from renewing in setInterval ajax web service call?

Question

I have a control that i've written that has a javascript component and a web service component. The problem i'm having is that the javascript is set to do:

setInterval(this._checkAlertsHandler, this._messageCheckInterval * 1000);

This calls a function which makes a webservice call like so:

Alert.SiteAlertService.GetAlerts(this._receivedAlertsHandler, this._errorReceivedAlertsHandler);

So this is using the web service javascript proxy methods to access the web service. The issue is that our application has forms authentication and a timeout value, so if the user is idle for too long it will log them out.

My webservice call apparently sends the cookie which includes the session and the forms authentication key to the web service. The asp.net webservice then automatically renews the session AND the forms authentication. Everytime the javascript hits the web service it basically keeps the user alive. I do not want this behavior, this should just circumvent that, so that even though this js is hitting the web service to check for new messages, if the user hasn't done a postback on our application (and is effectively idle) it will still log them out. This isn't happening :(

What i would like to happen is this interval call to the web service does not renew any authentication (the session renewal i can get around by using an application level variable with dictionary key/value for the users session id, so i dont have to use any session level variables).

How do i do this / change my web service / or control to work like the way i want it?

Answer 1

You could exclude your webservice from forms authentication:

<location path="yourwebservice.asmx">
    <system.web>
        <authorization>
            <allow users="?"/>
        <authorization>
    </system.web>
</location>  

But you probably need the information about the user, so you could configure the webservice to use forms authentication, but deactivate SlidingExpiration:

<location path="yourwebservice.asmx">
    <system.web>
        <authentication mode="Forms">
            <forms slidingExpiration="false"></forms>
        </authentication>
    </system.web>
</location>  

Be sure to test what happens if the forms cookie is expired. Maybe you'll have to redefine the loginurl, too.