会话超时在 ASP.NET MVC 中不起作用答案

【问题标题】：Session timeout does not work in ASP.NET MVC会话超时在 ASP.NET MVC 中不起作用
【发布时间】：2016-07-11 19:44:07
【问题描述】：

我已尝试使用 web.config 和 UseCookieAuthentication() 方法上的所有设置，如下所示：

Session timeout does not work ( is set in web.config )

How to set session timeout in web.config

mvc 5 session timeout after default period (20 mins)

但是，尝试将这些配置或方法中的所有选项的会话超时更改为 1 分钟（用于测试）没有任何意义，我不确定错误出在哪里。这是我更改的以下配置。任何想法来解决这个问题？我还需要澄清在 MVC 应用程序中设置会话超时的最佳方法是什么：在 web.config 中 或 在 Auth 类中？

web.config：

<system.web>
    <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5" executionTimeout="60" />

    <sessionState mode="InProc" timeout="1" />    

    <!-- For LDAP -->
    <httpCookies httpOnlyCookies="true" />
    <authentication mode="Forms">

        <!-- Note: I also remove this part and try with only "sessionState" -->
        <forms name=".ADAuthCookie" loginUrl="~/Account/Login" timeout="1" 
            slidingExpiration="false" protection="All" />
    </authentication>
</system.web>

Startup.Auth.cs：

public void ConfigureAuth(IAppBuilder app)
{
    // Code removed for brevity.

    // Configure the sign in cookie
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        LoginPath = new PathString("/Account/Login"),
        Provider = new CookieAuthenticationProvider
        {
            // Enables the application to validate the security stamp when the user logs in.
            // This is a security feature which is used when you change a password or add an external login to your account.  
            OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                validateInterval: TimeSpan.FromMinutes(1),
                regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
        }
    });            
    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

    app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(1));
    app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie);        
}

【问题讨论】：

标签： asp.net-mvc session authentication session-cookies session-state

【解决方案1】：

如果您使用ASP.NET Identity，则无需使用web.config 中的设置。只需将这两行添加到您的 UseCookieAuthentication() 方法中，如下所示：

....,
SlidingExpiration = true,
ExpireTimeSpan = TimeSpan.FromMinutes(1)
...

所以，你的方法的最终代码如下所示：

Startup.Auth.cs：

public void ConfigureAuth(IAppBuilder app)
{
    // Code removed for brevity.

    // Configure the sign in cookie
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        LoginPath = new PathString("/Account/Login"),
        Provider = new CookieAuthenticationProvider
        {
            // Enables the application to validate the security stamp when the user logs in.
            // This is a security feature which is used when you change a password or add an external login to your account.  
            OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                validateInterval: TimeSpan.FromMinutes(30),
                regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
        },            
        SlidingExpiration = true, 
        ExpireTimeSpan = TimeSpan.FromMinutes(1) //Set the session timeout at here
    });            
    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

    app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(1));
    app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie);        
}

欲了解更多信息，请访问ASP.NET-Identity-Cookie-Authentication-Timeouts。希望这会有所帮助...

【讨论】：