Windows Authentication Timeout

Question

How can you suspend access to a user session after a specified interval of inactivity when using Windows Integrated Security for a ASP.NET MVC Website .

Thanks in advance,

Radu

Answer 1

When using Kerberos for authentication Internet Explorer (IE) will continue sending the same credentials for each subsequent request to the server until one of two things happens: a) The user closes their browser. b) The server refuses the credentials with a 401 status code. This behavior is KB 264921.

If we want to simulate a session than we have to implement the following steps: 1. Create a sliding expiration cookie for the duration of the session 2. Check for that cookie for every request: begin_request or global filters. If the cookie is missing return a 401 status code for that specific request. 3. Next request will trigger the authentication prompt.

I was hoping someone else having a better ideea, this one feels kind of hacky.