在 FormsAuthenticationTicket 超时中途发出新的会话 cookie
我在我的 asp.net 4.0 应用程序（从 .NET 1.1 升级）中使用表单身份验证。我显式创建 FormsAuthenticationTicket 对象，然后对其进行加密（使用 FormsAuthentication 方法），并将其在 cookie 中发送到客户端。我使用 FormsAuthentiation.RenewTicketIfExpired() 来设置身份验证 cookie 的滑动过期时间。
我能够使用 Fiddler 找出 FormsAuthenticationTicket 超时中途发出的新会话 cookie。
如果 formsauthentication 超时 = 2 分钟，会话超时 = 20 分钟，
即
hh:mm:ss
10:00:00 用户登录
10:01:10 发生回发
，则将重新创建一个新会话并注销。但我将会话设置为每 20 分钟超时一次。我尝试了不同形式的身份验证超时值，并且总是在超时的中间创建一个新会话。
我需要将表单验证超时设置为一个非常大的值以避免这种情况发生。
从.NET 1.1升级之前没有这样的问题
有人知道为什么吗？这是 asp.net 4.0 中处理滑动过期的错误吗？
I am using Forms authentication in my asp.net 4.0 application (upgraded from .NET 1.1). I explicitly create the FormsAuthenticationTicket object, then encrypt it (using a FormsAuthentication method), and send it in a cookie to the client. I use FormsAuthentiation.RenewTicketIfExpired() to set the sliding expiration of the authentication cookie.
I am able to use Fiddler to find out a new session cookie issued halfway through FormsAuthenticationTicket timeout.
if formsauthentication timeout = 2 min, session timeout = 20 min
i.e.
hh:mm:ss
10:00:00 user logs in
10:01:10 postback occurs
Then a new session will be re-created and got logged out. But i set the session to time out every 20 minutes. I tried different formsauthentication timeout values and a new session is always created halfway through the timeout.
I need to set the formsauthentication timeout to a very big value to avoid this from happening.
There's no such problem before the upgrade from .NET 1.1
Does anybody know why? is this a bug for dealing with sliding expiration in asp.net 4.0?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
即使问题很老，也要写下答案，以防有人像我一样遇到这个问题。
这不是一个错误，新票证会在超时时间过半时发出，因为您有 SlidingExpiration=yes 这是默认值。
当启用滑动到期时，如果超过一半的超时时间已过，FormsAuthentication 将重新发出 FormsAuthentication 票证，有效期为 x 分钟，其中 x 是表单身份验证超时设置。
从技术上讲，即使每个请求到达服务器时都会发生这种情况（不仅仅是在一半的超时消失之后）并且一些文档说这就是它的完成方式，但可能出于性能原因而没有这样做，并且有些浏览器似乎不喜欢频繁设置 cookie。
请参阅 http://msdn.microsoft.com/ en-us/library/system.web.configuration.formsauthenticationconfiguration.slidingexpiration.aspx
Writing an answer even if the question is very old, in case someone bumped into this just like I did.
This is not a bug, new ticket is issued halfway through the timeout becuase you have SlidingExpiration=yes which is the default.
When the sliding expiration is on, FormsAuthentication will re-issue a FormsAuthentication ticket valid for another x number of minutes where x is your forms authentication timeout setting, if more than half of the timeout period is elapsed.
Technically, even though this should happen with every request hitting the server (not only after half of the timeout is gone) AND SOME DOCUMENTATION SAYS THAT'S HOW IT'S DONE , it's not done so probably for performance reasons, and some browsers seem to dislike setting cookies that frequently.
See http://msdn.microsoft.com/en-us/library/system.web.configuration.formsauthenticationconfiguration.slidingexpiration.aspx
您的网站可能会被回收。发生这种情况可能有几个原因。最近引起我注意的是站点目录结构发生变化（例如添加文件夹）。
既然您知道它发生在哪里，只需确保您不会造成任何回收。
Your site could be recycling. This may happen for a couple of reasons. One that recently caught me was when the site directory structure changed (e.g. adding a folder).
Since you know where it is happening just make sure that you are not causing any recycling.