.net会话和用户cookie持久身份验证

Question

Here is the scenario:

A user is logged on and a Session has been created on the server along with an authentication cookie on the client side.

The Session timeout is set to 20 minutes.

After 25 minutes of inactivity the user goes back onto the website, so his Session does not exist anymore but the authentication cookie still exists.

Based on the cookie what's the best and secured way to allow the user to get signed in automatically...

Thanks in advance for any help.

Answer 1

First, sign on automatically, should be a option, some users doesn't want it.

Second, if the user has that option active and the authentication cookie still exists you only need to create a new session. You don't need to really authenticate the user, just give him a cookie. :-P.