Develop Reference

Logout in one application cause logout in another one

I have two different web applications hosted in same server .
and in one application i have link to the second one .
If a user login in first application and click the link to second one ,
the user automatically login as i pass the login information through query string .
The Problem :
If the user click on logout button in any of these application , automatically loose session in the other one too
Why this happen ? How can i overcome this ?

I got the Issue , I have same domain name for both of these applications .
As it has same domain name the cookie and session ids are same . Hosted these applications with different domain names and the issue gone ..!

If you are using Forms Authentication you should change cookie name in web.config
<system.web>
<authentication mode="Forms">
<forms name=".SOMENAME" requireSSL="false" protection="All" loginUrl="~/Security/Login" timeout="2880" />
</authentication>
</system.web>

Session time out Logout Url ASP.Net

I have an issue with my ASP.Net web app built in 4.0 framework.
I have the below set in the web config -
<authentication mode="Forms">
<forms loginUrl="~/SignIn.aspx" protection="All" timeout="2880" path="/" />
</authentication>
when a user clicks my url he sees the login page.
Now the session timeout is set to the default session time out from IIS which is 20 minutes.
Now when the session expires I would like to force the user to redirect to Logout.aspx
How can I achieve this? I would like to redirect the user to Logout.aspx page once the session times out.

The short answer is to check HttpContext.Current.Session.IsNewSession on each page request to see if the user's session timed out and has started a new session. In the event that it is a new session, redirect the user to the page of your choosing.
If you're using MVC or even just want to see a more thorough explanation of session timeouts in action, check out http://tyronedavisjr.com/2008/11/23/detecting-session-timeouts-using-a-aspnet-mvc-action-filter/ for an example.

Timeout option for Simplemembership

Does simplemembership have an easy way to set a timeout to automatically log you out after a certain amount of time has passed while you've been inactive?

SimpleMembership doesn't provide a timeout you can configure, the authentication mechanism does.
If you are using FormsAuthentication, you can setup this timeout here:
<authentication mode="Forms">
<forms loginUrl="~/Login" timeout="20" slidingExpiration="true" />
</authentication>
In the example above the timeout is set to 20 minutes. This means that the authentication cookie (containing the authentication ticket) will expire after 20 minutes of inactivity once the user is authenticated.
The membership provider is responsible to validate the user credentials, among other responsibilities. However it is not responsible of "recognizing" subsequent request for authenticated users.
Please check this article so you have a better idea about what is happening behind the scene.

Session_End in Global.asax.cs not firing using forms authentication

I have an asp.net 4.0 application that is using forms authentication set to a timeout at 45 minutes. I would like to redirect the user to a timeout page when the session has expired. Can anyone tell me how to do this? I am running .net 4.0.
web.config has:
<authentication mode="Forms">
<forms name=".ASPXAUTH" loginUrl="~/Login.aspx"
defaultUrl="~/Default.aspx" protection="All" timeout="45"
requireSSL="false">
</forms>
</authentication>
Global.asax.cs file has:
void Session_End(object sender, EventArgs e)
{
Response.Redirect("~/Timeout.aspx");
}

It's not possible to do a redirect in the Session_End method. It's not running as a result of a request, so it doesn't have a Response object and there is no response to redirect anywhere.
It's not possible to do anything in the browser as a result of the session expiring. The HTTP protocol is request oriented, so there is no way to push a message from the server to the browser without the browser asking for it.
The browser just can't find out if the session has expired or not. If you would poll the server to check if the session has expired, it would keep the session alive, defeating the purpose of the timeout.
You can make a redirect after 45 minutes using just client script:
window.setTimeout(function() {
window.location.href = '/Timeout.aspx';
}, 1000*45*60);
However, this will make the redirect only based on the time since this browser window last contacted the server. If you have more than one browser window for the same session, it's possible that the session has actually not timed out.

How is your session state implemented? Session_End only works when you are using InProc.
See http://www.eggheadcafe.com/articles/20021016.asp

On MVC you can adding this code in _ViewStart.cshtml
_ViewStart.cshtml:
#{
Response.AddHeader("Refresh",Convert.ToString((Session.Timeout * 60) + 5));
if(Session.IsNewSession)
Response.Redirect(“Logout.aspx");// or another page which you want.
}
How to Redirect on Session End

ASP.NET/IIS: Log out all users

In an ASP.NET 3.5 application running on IIS, how do I force a "deauthentication" of all currently logged-in and authenticated users?
iisreset didn't seem to do the trick!

Changing the authentication form name will then require new authentication from all users.
From:
<authentication mode="Forms">
<forms name="originalName" loginUrl="~/Account/Login" />
</authentication>
To:
<authentication mode="Forms">
<forms name="differentName" loginUrl="~/Account/Login" />
</authentication>

ASP.NET authentication is designed to be resilient to an IISReset due to its use of cookies - performing an IISReset will clear any in-memory information, but the next time a user asks for a page on your site, they will send their authentication token, which (if it hasn't timed out) will still be valid, and the server will re-authenticate them.
You could write something that would effectively log out the user after a restart, by (for example) storing the application start time in a global variable in Application_Start, and then comparing the users LastActivityDate with that value - if it's before the start time, then you can call the appropriate sign-out method during Application_SessionStart or Application_BeginRequest.