ASP.NET - Auto logout in asp.net

Asked By Aksara L.P on 28-Jul-11 07:35 AM

Auto logout in asp.net

Jitendra Faye replied to Aksara L.P on 28-Jul-11 07:37 AM

In ASP.NET this is some thing like hard. But for the Forms Authentication, you can set time out. When that time out occures and during that time now any activities occurred, login session end up. When the user does any activity after that, he will be redirected to the login page.

You can set time out in Forms Authentication like below.

Here time out period is considered in minutes and default timeout is 30 minutes.

Reena Jain replied to Aksara L.P on 28-Jul-11 07:39 AM

Hi,

In the Page_Load event of the page where you want to logout the users, put the following code:-

if(User.Identity.IsAuthenticated)

{

FormsAuthentication.Signout();

}

this will automatically signout user's who are logged in.

or

You can configure this on your web.config file.

Kalit Sikka replied to Aksara L.P on 28-Jul-11 07:40 AM

in web.config file ,
change the timeout value. i have set "timeout=20"

<sessionState mode="InProc" stateConnectionString="tcpip=127.0.0.1:42424" sqlConnectionString="data source=127.0.0.1;Trusted_Connection=yes" cookieless="false" timeout="20" />

Riley K replied to Aksara L.P on 28-Jul-11 07:45 AM

I'm not sure if you're after something that will log the user out after a certain time regardless of activity, or just after a period of inactivity.

If you're using standard http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx, this can be done for you without any major work:

but you did not provide enough info

Set up your http://msdn.microsoft.com/en-us/library/6e9y4s5t.aspx.

Ensure that your http://msdn.microsoft.com/en-us/library/532aee0e.aspx defines a loginUrl:

<authentication mode="Forms">
  <forms loginUrl="login.aspx" />
</authentication>

You can set a timeout other than the default 30 minutes using the "timeout" attribute on the http://msdn.microsoft.com/en-us/library/1d3t3c61.aspx:

<authentication mode="Forms">
  <forms loginUrl="login.aspx" timeout="15"/>
</authentication>

This will log the user out after 15 minutes of inactivity on your site (either with the browser open with no javascript "heartbeat" or if they spend 15 minutes on another site).

Then ensure that your login, registration and possibly forgotten password pages are accessable to all users using the http://msdn.microsoft.com/en-us/library/b6x6shw7.aspx

<location path="Logon.aspx">
  <system.web>
    <authorization>
      <allow users="?"/>
    </authorization>
  </system.web>
</location>
<location path="Register.aspx">
  <system.web>
    <authorization>
      <allow users="?"/>
    </authorization>
  </system.web>
</location>
<!-- etc -->

This way, when a user's authentication cookie expires they will be redirected to the URL specified in the loginUrl element of your forms page.

Hope you got enough idea.

The next time you post a question give some brief description,

Radhika roy replied to Aksara L.P on 28-Jul-11 11:02 AM

Going on the comments as much as the question, I'm not sure if you're after something that will log the user out after a certain time regardless of activity, or just after a period of inactivity.

If you're happy to use the standard http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx, this can be done for you without any major work:

Set up your http://msdn.microsoft.com/en-us/library/6e9y4s5t.aspx.

Ensure that your http://msdn.microsoft.com/en-us/library/532aee0e.aspx defines a loginUrl:

<authentication mode="Forms">
  <forms loginUrl="login.aspx" />
</authentication>

You can set a timeout other than the default 30 minutes using the "timeout" attribute on the http://msdn.microsoft.com/en-us/library/1d3t3c61.aspx:

<authentication mode="Forms">
  <forms loginUrl="login.aspx" timeout="15"/>
</authentication>

This will log the user out after 15 minutes of inactivity on your site (either with the browser open with no javascript "heartbeat" or if they spend 15 minutes on another site).

Deny access to anonymous users

<authorization>
  <deny users="?" />
</authorization>

Then ensure that your login, registration and possibly forgotten password pages are accessable to all users using the http://msdn.microsoft.com/en-us/library/b6x6shw7.aspx

<location path="Logon.aspx">
  <system.web>
    <authorization>
      <allow users="?"/>
    </authorization>
  </system.web>
</location>
<location path="Register.aspx">
  <system.web>
    <authorization>
      <allow users="?"/>
    </authorization>
  </system.web>
</location>
<!-- etc
-->

This way, when a user's authentication cookie expires they will be redirected to the URL specified in the loginUrl element of your forms page.

Hope this will help you.