Automatically log out user or warn user

Question

User657329123 posted

Hi there,

My Startup.Auth.cs file has the following and I'm using MS Identity v2.2.1. User is authenticated against corporate AD.

        public void ConfigureAuth(IAppBuilder app)
        {
            app.CreatePerOwinContext(ApplicationDbContext.Create);
            app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);
            app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create);

            // Configure the sign in cookie
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Account/Login"),
                Provider = new CookieAuthenticationProvider
                {
                    OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                        validateInterval: TimeSpan.FromMinutes(30),
                        regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
                }
            });            
            app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

            app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(5));

           app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie);

        }

As per this code, cookie expires after every 30 mins of inactivity.  After 30 mins of inactivity how do I log out user automatically and bring the user to log in page or display a message that their session is over and they need to log in again.

Joe

Answer 1

User475983607 posted

As per this code, cookie expires after every 30 mins of inactivity.  After 30 mins of inactivity how do I log out user automatically and bring the user to log in page or display a message that their session is over and they need to log in again.

Can you clarify the problem?  The configuration redirects the user to the login page when the user clicks a link or button after being idle for 30 minutes.  

By automatic, do you mean the browser should redirect after the idle timeout?  If so, you write a JavaScript timer application that timeouts after 30 minutes and is loaded on every page.

<script>
	setTimeout(function(){ window.location = "/Account/Login"; }, 1000 * 60 * 30);
</script>

https://www.w3schools.com/jsref/met_win_settimeout.asp

https://developer.mozilla.org/en-US/docs/Web/API/Window/location

Answer 2

User657329123 posted

Yes I want browser or application to keep track of time. E.g. User logs in and starts filling out a form, completes form halfway then walks away for an hour. After an hour when user returns, since the browser window is still open, starts completing form. When Submit button is clicked, controller complains hey your session has timed out. So I was trying to think if there a way to log user out when 30 mins are over or display message so that user doesn't spend time completing form only to notice that their session is over.

Answer 3

User475983607 posted

Yes I want browser or application to keep track of time. E.g. User logs in and starts filling out a form, completes form halfway then walks away for an hour. After an hour when user returns, since the browser window is still open, starts completing form. When Submit button is clicked, controller complains hey your session has timed out. So I was trying to think if there a way to log user out when 30 mins are over or display message so that user doesn't spend time completing form only to notice that their session is over.

The code above will redirect the user.  Add a querystring to the URL to display a message on the login page.

<script>
	setTimeout(function(){ window.location = "/Account/Login?message=Your session timed out"; }, 1000 * 60 * 30);
</script>