asp.net会话和表单身份验证时间性能在服务器上命中？

Question

So I was given the task to set the session time out to 24hr, doing some reading on the web i found out that i also need to set the forms authentication to that time frame so the user is not logged out. My question is , are there any drawbacks on the server side? Will it work harder/slower thanks to the fact that it has to keep all those sessions in check ?

Answer 1

Its actually a bit more complex than that. I can't remember which is which but they have different expiries. Session timeout resets with every request whereas the forms auth ticket only resets after at least half the time out has expired. So this needs to be double the size of the session timeout.

Answer 2

Will it work harder/slower thanks to the fact that it has to keep all those sessions in check ?

There is no performance improvement or slow down for Server except that user doesn't need to re-login and server doesn't need to authenticate the user again.

Once user is logged-in, server checks authentication cookie whether is still valid on every post back (doesn't matter how long or how short you set the timeout) .

Normally, you want to set form authentication time out to be larger than session time out.

For example,

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login.aspx" timeout="2880"/>
</authentication>

<sessionState timeout="1440"/>