asp.net redirecting to login page

Question

If I have set the forms authentication timeout to 30 days (in minutes) and I have set the session timeout to 5 mins and I am using a cookie to persist the different session variables .. why does asp.net or IIS always always issue a 302 and redirects to the login page when the session times out ? (Doing http debugging it puts an "object moved to here" message)

I am checking the session in all page_init s on all pages since they all inherit from a common Page class, if I find a faulty session i load the session variables from the cookie mentioned above.

My question is, who or what is redirecting to the login page!!?

I have tested this on IIS6 & IIS7 with identical results.

I have put breakpoints on every single redirect statement and they never fired, and hence I have concluded that something else is issuing those redirects.

further debbuging revealed the following:

A first chance exception of type 'System.Threading.ThreadAbortException' occurred in mscorlib.dll An exception of type 'System.Threading.ThreadAbortException' occurred in mscorlib.dll but was not handled in user code

But I guess that is natural since it is issuing a redirect anyway.

Answer 1

It is the forms authentication that does this. If you are not authenticated forms authentication will send you to the loginurl.

see: http://msdn.microsoft.com/en-us/library/ff647070.aspx

The reason why you cannot debug this is that forms authentication takes the request before it gets to your code.

It is also covered at the end of this article

Edit

From the second link above:

Issue scenario: The forms authentication may time out before the timeout attribute value that is set in the configuration file If the forms authentication ticket is manually generated, the time-out property of the ticket will override the value that is set in the configuration file. Therefore, if that value is less than the value in the configuration file, the forms authentication ticket will expire before the configuration file timeout attribute value and vice-versa. For example, let's assume that the timeout attribute is set to 30 in the Web.config file and the Expiration value of the ticket is set to 20 minutes. In this case, the forms authentication ticket will expire after 20 minutes and the user will have to log on again after that.