Home → Support →

Forms Auth Cookie Expiration happens very quickly?

• Edit

rukednous

04 May, 2011 02:21 AM

My FormsAuthentication cookies seem to behave a bit differently on my local machine that they do deployed on AppHarbor. I want to let users stay logged-in for a good long while, but I seem to have to log in to my app myself pretty frequently (more than once on a 40 minute train ride). At home, I've been taken by surprise because when I load it up to work on it, I seem to still be logged in from the previous evening. So it seems like it's working as I intended on localhost, but not on AppHarbor.

I think I've got an idea of what the trick might be, but I'm not entirely sure. Maybe I'm missing some secret sauce here.

Logging in using Forms Auth seems to work fine, at least for about 30 minutes or so, so I'm wondering if the issue is this:

FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
                        1,
                            userName,
                            DateTime.Now,
                            DateTime.Now.AddDays(30),
                            true,
                            userName
                        );

                string encTicket = FormsAuthentication.Encrypt(authTicket);
                this.Response.Cookies.Add(
                    new HttpCookie(
                        FormsAuthentication.FormsCookieName,
                        encTicket) { Expires = authTicket.Expiration });

Is encrypting the AuthTicket going to give me trouble because the Machine Key of the host server is subject to change? It seems like I could resolve this by specifying my decryptionKey and validationKey in web.config, but I'm wondering if I'm barking up the wrong tree.

1. 1 Posted by leedumond on 05 May, 2011 02:13 AM

   

   Interesting... I seem to be having the exact same issue...

   • Edit

2. Support Staff 2 Posted by friism on 05 May, 2011 06:26 PM

   

   You should not not use the server machine key, as we may move your app around between servers. You can specify your own machine key in the application web.config.

   Since you do not currently specify a machine key, a new one is generated every time your application apppool is restarted. AppHarbor may spin down your website if it is not active to conserve resources. This is the most likely cause of the quick session expirations you are seeing.

   Let us know how this works out for you.

   • Edit

3. friism closed this discussion on 05 May, 2011 06:26 PM.