ansaurus

Question

Display message to user when forms authentication session expires

Answer 1

A:

Try this JavaScript on for size:

Make sure that a property called LoginPageUrl exists on the code behind. Great for Master pages.

If you want to register the script from code-behind, you could even pull the session timeout from the application and inject it so that you still only have one place (web.config) to update it.

To display a message to the user after redirecting them to the login page (.NET will take care of expiring the cookie), send a query string parameter that the login page looks for and shows a message indicating that the user was logged out due to inactivity.

<head>
...
</head>
<body onload="logoutOnExpire();" >
<script type="text/javascript">
        // ACTIVITIES TO RUN FOR THE PAGE
        function logoutOnExpire() {
            clearTimeout(logoutTimeout);
            logoutTimeout =
               setTimeout('location.href = '<%= LoginPageUrl %>';', 1200000);
               // 20 minutes
        }
</script>
<form id="form" runat="server">
...
</form>
</body>
</html>

Brad 2010-10-21 15:20:17

I don't want to warn the user they are about to be logged out... I find that annoying, if I step away for 20 minutes of course I should be logged out. Plus I don't need to redirect the user, .NET does that for me. I want to tell the user WHY when the try to click on something else they were sent back to the login page. The logic I am looking for or remembering talks to the forms authentication ticket in the code-behind for the login page and lets me show an error then.

Brent Pabst 2010-10-21 20:33:36

@Brent, yes, .NET will do that for you, however, it won't do it until another postback (control event). I thought you wanted something automatic. If you use this JavaScript, you can pass along a querystring parameter that the login page looks for that indicates that you were redirected here due to inactivity.

Brad 2010-10-22 12:33:24

@Brad, thanks, no I don't need it to be automatic. The onPostback event is fine. Reduces the amount of code I have to write and manage if I am just using the built-in methods. Does that not make the most sense?

Brent Pabst 2010-10-25 15:24:27

@Brent, it all depends on user-experience. Look at the second answer I posted about redirecting on postback if user is found to be unauthenticated.

Brad 2010-10-25 15:30:13

Well, never did find what I remember doing before, I'll have to keep searching but this is the best answer otherwise. Thanks

Brent Pabst 2010-10-26 11:50:34

Answer 2

A:

You can check the session in the inner page and if session does not exist,Redirect to the login page with some value in querystring to understand from which page this call came.When user logged in back,You can use the querystring value to determine which page to be displayed back.

MyPage.aspx.cs,In Page load you can check,

if(Session["user"]==null)
{
  Response.Redirect("Login.aspx?from=mypage");
}
else
{
  // Do the other stuff for the loged in user
}

And In Login.aspx.cs,In the code where you check your login details from the form

string userName=txtUserName.Text; 
string password=txtPass.Text;
if(IsValidLogin(userName,password)
{
  string toUrl="defaul.aspx";
  if(Request.QueryString["from"]!=null)
  {
   string fromPage=Request.QueryString["from"];
    if(fromPage=="mypage")
    {
       toUrl="mypage.aspx";
    }
    else if(fromPage=="review")
    {
       toUrl="review.aspx";
    }
  }
  Response.Redirect(toUrl);
}

Shyju 2010-10-21 15:27:09

The whole idea was to not have to override .NET's default behavior of sending the user back to the login page. How do I figure out the session ended once at the login page without having to pass a querystring. I have done this before!

Brent Pabst 2010-10-21 20:34:43

Answer 3

A:

If what you want is to send the user to a page other than the login page when they cause a server postback after their session expires, use the following code at the top of the Page_Load event (this may not work if .NET executes it's redirect first).

if(!Context.User.Identity.IsAuthenticated)
{
    Response.Redirect("~/OtherPage.aspx", false);
}

If you create a base page in your website that all pages inherit from, add it to that page's Page_Load.

Brad 2010-10-22 12:39:53

Answer 4

A:

If you are redirected to the default login page, after an attempt to use a page after your session has been timed out, is not the redirecturl param set to the page you were trying to access.

So you could infer that if that is set they were previously on a page and then present your message about being logged out due to going for lunch., etc.

MattC 2010-10-25 16:07:40

ansaurus

tags:

views:

answers:

Display message to user when forms authentication session expires

related questions