Take the 2-minute tour ×

This is really irritating me, and is probably causing the waning usership on my website. I'm using Forms Authentication to log my user in.

I have the "Persist" parameter set to true by default when the user logs in:

RedirectFromLoginPage(userString, True)


SetAuthCookie(userString, True)

In my web.Config file I have the "timeout" attribute set to "129600":

<authentication mode="Forms">
    <forms loginUrl="/registration/login.aspx"
    timeout="129600" slidingExpiration="true" />

I called my hosting company and they said the problem has to be with my code. I don't believe this is the case.

What the #(@%&@(#%&@(#*% could be wrong??

EDIT This used to work fine until I switched hosts. That led me to believe that it was not my code, but in fact the host.

EDIT 2 In response to a comment to use Fiddler, here's what I get from Fiddler when I load the page:

Set-Cookie: .ASPXAUTH=; expires=Tue, 12-Oct-1999 07:00:00 GMT; path=/; HttpOnly
Set-Cookie: .ASPXAUTH=[some gobbledygook]; 
  expires=Sun, 15-Nov-2009 20:46:29 GMT; path=/; HttpOnly
Set-Cookie: ASP.NET_SessionId=vudqghfplqnh5hz1qw1cwebt; path=/; HttpOnly
share|improve this question
add comment

6 Answers

Your app pool could be recycling - either on some set time period, or based on a threshold on memory or processor. If it used to work fine, and nothing else changed, I think that would be where I would investigate first.

share|improve this answer
is this something the host controls? –  Jason Aug 17 '09 at 21:54
ugh... my host is godaddy... guess this problem isn't going away any time soon... –  Jason Aug 17 '09 at 22:00
This should not log you out. Session state is succeptible to this if inproc is used. But forms auth is not session state based - it's just a cookie... –  UpTheCreek Nov 16 '10 at 14:44
Having said that - if the machinekey in the machine level web.config is set to autogenerate then the encryption key for the .aspxauth cookie will change after restart, invalidating the cookie. –  UpTheCreek Nov 16 '10 at 16:30
add comment

There are a number of things that could be causing a timeout. This Blog provides a great overview.

share|improve this answer
This article talks about session state - this has nothing to do with forms auth an the .aspxauth cookie. –  UpTheCreek Nov 16 '10 at 14:37
add comment

You could use Fiddler to verify the expiration date set on the cookie that comes back from the login page.

share|improve this answer
see my edit 2 for my fiddler response –  Jason Aug 17 '09 at 20:50
why won't the second cookie stay? –  Jason Aug 18 '09 at 0:52
add comment

As you know I have a similar problem. What might be happening is the application pool is shutting down.

Do a test: open your session in 2 different browsers and in one of them reload the web page in less than 20 minutes, while in the other do nothing.

What might happen is that you won't get logged off of any of them because the app pool is kept alive.


Try this: http://authors.aspalliance.com/paulwilson/articles/?id=12

share|improve this answer
ugh. this sucks. thanks for the research –  Jason Dec 14 '10 at 19:14
add comment

The cause of this behavior for me is usually the IIS Idle Timeout.

share|improve this answer
add comment

Don't forget to use sessionstate timeout.

share|improve this answer
add comment

Your Answer


